Getting Data In

Props.conf: Why isn't my mask working?

morphis72
Path Finder

I'm trying to mask out of the log below and I'm not sure what I'm doing wrong.

log:

[22/Apr/2020:19:29:57 -0400] MODIFY INT conn=88927 op=65 msgID=66 PLUGIN=Modify: modifications: [Modification(replace, Attribute(userPassword, {userpassword})]

my props.conf

[source::mysourcetype]

SEDCMD-mask = ^\[.+\sPLUGIN=Modify: modifications: \[Modification\(replace, Attribute\(userPassword, {.+}(.+)/(userPassword, {#####}\g/1

But, it's not matching and replacing the password with the #####'s

0 Karma
1 Solution

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @morphis72,

The sed command you wrote replaces the entire log line instead of removing the password. Try out your regex here :
https://regex101.com/

Also there is no need to type in the entire log line for sed to match, you can go for something similar as follows :

[password-Anon]
SEDCMD-Anon = s/Attribute\(userPassword, {userpassword}\)/Attribute(userPassword, {xxxxxxxxxxxx})/g 

The guide is here if you need more details :
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_with_a_sed_scr...

One last thing, make sure the stanza for sourcetype in props.conf is :

[mysourcetype]

and not :

[source::mysourcetype]

Let me know if that helps.

Cheers,
David

0 Karma

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

0 Karma

jawahir007
Path Finder

Try this : -

SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@morphis72

Can you please try this?

SEDCMD-mask = 's/.*Attribute\(userPassword, {(.*)}\)\]/.*Attribute\(userPassword, {#####}\)\]$/
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...