Getting Data In

Mask partial value in Splunk _raw Data using SED

Shashank_87
Explorer

Hi, I have the below event in my splunk logs and i want to partially mask few things -
1. I want to just remove the IP's which is at the end of 2nd line - 12.12.12.12
2. I want to partially mask the digits in between from this - number: 441234567809. Like 44******809.
And i want to do this in _raw events because i will be exporting the _raw file from Splunk after masking

--5f72c-A--
[21/May/2019:23:55:01 +0100] dffsdfsdfds129.654.234.92 5666 12.12.12.12
--5472c-B--
GET /testHTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip
User-Agent: okhttp/3.10.0
number: 441234567809

Can someone please guide how to do this using sed command?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

All this is part of single event? Do you want to mask the data at index time OR search time?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

If you want to mask data at search time you can use below regex.

<yoursearch>
| rex field=_raw mode=sed "s/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\v)/\1/"
| rex field=_raw mode=sed "s/(number\:\s\d{2})\d+(\d{3})/\1***\2/"
0 Karma

Shashank_87
Explorer

Just to add on to the above :
I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line -
| rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g"

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...