Getting Data In

Mask partial value in Splunk _raw Data using SED

Shashank_87
Explorer

Hi, I have the below event in my splunk logs and i want to partially mask few things -
1. I want to just remove the IP's which is at the end of 2nd line - 12.12.12.12
2. I want to partially mask the digits in between from this - number: 441234567809. Like 44******809.
And i want to do this in _raw events because i will be exporting the _raw file from Splunk after masking

--5f72c-A--
[21/May/2019:23:55:01 +0100] dffsdfsdfds129.654.234.92 5666 12.12.12.12
--5472c-B--
GET /testHTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip
User-Agent: okhttp/3.10.0
number: 441234567809

Can someone please guide how to do this using sed command?

0 Karma

somesoni2
Revered Legend

All this is part of single event? Do you want to mask the data at index time OR search time?

0 Karma

harsmarvania57
Ultra Champion

Hi,

If you want to mask data at search time you can use below regex.

<yoursearch>
| rex field=_raw mode=sed "s/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\v)/\1/"
| rex field=_raw mode=sed "s/(number\:\s\d{2})\d+(\d{3})/\1***\2/"
0 Karma

Shashank_87
Explorer

Just to add on to the above :
I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line -
| rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...