Getting Data In

Props.conf: Why isn't my mask working?

morphis72
Loves-to-Learn Lots

I'm trying to mask out of the log below and I'm not sure what I'm doing wrong.

log:

[22/Apr/2020:19:29:57 -0400] MODIFY INT conn=88927 op=65 msgID=66 PLUGIN=Modify: modifications: [Modification(replace, Attribute(userPassword, {userpassword})]

my props.conf

[source::mysourcetype]

SEDCMD-mask = ^\[.+\sPLUGIN=Modify: modifications: \[Modification\(replace, Attribute\(userPassword, {.+}(.+)/(userPassword, {#####}\g/1

But, it's not matching and replacing the password with the #####'s

0 Karma
1 Solution

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @morphis72,

The sed command you wrote replaces the entire log line instead of removing the password. Try out your regex here :
https://regex101.com/

Also there is no need to type in the entire log line for sed to match, you can go for something similar as follows :

[password-Anon]
SEDCMD-Anon = s/Attribute\(userPassword, {userpassword}\)/Attribute(userPassword, {xxxxxxxxxxxx})/g 

The guide is here if you need more details :
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_with_a_sed_scr...

One last thing, make sure the stanza for sourcetype in props.conf is :

[mysourcetype]

and not :

[source::mysourcetype]

Let me know if that helps.

Cheers,
David

0 Karma

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

View solution in original post

0 Karma

jawahir007
Explorer

Try this : -

SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@morphis72

Can you please try this?

SEDCMD-mask = 's/.*Attribute\(userPassword, {(.*)}\)\]/.*Attribute\(userPassword, {#####}\)\]$/
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!