Props.conf: Why isn't my mask working?

[morphis72]

I'm trying to mask out of the log below and I'm not sure what I'm doing wrong.

log:

[22/Apr/2020:19:29:57 -0400] MODIFY INT conn=88927 op=65 msgID=66 PLUGIN=Modify: modifications: [Modification(replace, Attribute(userPassword, {userpassword})]

my props.conf

[source::mysourcetype]

SEDCMD-mask = ^\[.+\sPLUGIN=Modify: modifications: \[Modification\(replace, Attribute\(userPassword, {.+}(.+)/(userPassword, {#####}\g/1

But, it's not matching and replacing the password with the #####'s

[DavidHourani]

Hi @morphis72,

The sed command you wrote replaces the entire log line instead of removing the password. Try out your regex here :
https://regex101.com/

Also there is no need to type in the entire log line for sed to match, you can go for something similar as follows :

[password-Anon]
SEDCMD-Anon = s/Attribute\(userPassword, {userpassword}\)/Attribute(userPassword, {xxxxxxxxxxxx})/g 

The guide is here if you need more details :
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_with_a_sed_scr...

One last thing, make sure the stanza for sourcetype in props.conf is :

[mysourcetype]

and not :

[source::mysourcetype]

Let me know if that helps.

Cheers,
David

[PavelP · Accepted solution]

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

[jawahir007]

Try this : -

SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g

[kamlesh_vaghela]

@morphis72

Can you please try this?

SEDCMD-mask = 's/.*Attribute\(userPassword, {(.*)}\)\]/.*Attribute\(userPassword, {#####}\)\]$/