Getting Data In

Props.conf: Why isn't my mask working?

morphis72
Path Finder

I'm trying to mask out of the log below and I'm not sure what I'm doing wrong.

log:

[22/Apr/2020:19:29:57 -0400] MODIFY INT conn=88927 op=65 msgID=66 PLUGIN=Modify: modifications: [Modification(replace, Attribute(userPassword, {userpassword})]

my props.conf

[source::mysourcetype]

SEDCMD-mask = ^\[.+\sPLUGIN=Modify: modifications: \[Modification\(replace, Attribute\(userPassword, {.+}(.+)/(userPassword, {#####}\g/1

But, it's not matching and replacing the password with the #####'s

0 Karma
1 Solution

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @morphis72,

The sed command you wrote replaces the entire log line instead of removing the password. Try out your regex here :
https://regex101.com/

Also there is no need to type in the entire log line for sed to match, you can go for something similar as follows :

[password-Anon]
SEDCMD-Anon = s/Attribute\(userPassword, {userpassword}\)/Attribute(userPassword, {xxxxxxxxxxxx})/g 

The guide is here if you need more details :
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_with_a_sed_scr...

One last thing, make sure the stanza for sourcetype in props.conf is :

[mysourcetype]

and not :

[source::mysourcetype]

Let me know if that helps.

Cheers,
David

0 Karma

PavelP
Motivator

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

0 Karma

jawahir007
Communicator

Try this : -

SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@morphis72

Can you please try this?

SEDCMD-mask = 's/.*Attribute\(userPassword, {(.*)}\)\]/.*Attribute\(userPassword, {#####}\)\]$/
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...