Getting Data In

SEDCMD a field

JDukeSplunk
Builder

I'm hoping what I want to do exists.

I've reviewed props.conf.spec and https://docs.splunk.com/Documentation/Splunk/7.2.5/Data/Anonymizedata. I can't find where the documentation says that it is possible to execute a SEDCMD in props.conf against a specific field. We have a csv file that the forwarder assigns fields to from the csv header using it's local props.conf for the sourcetype.

Forwarders props.conf, which is standard csv boilerplate.

[hdfax:prod]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

So those fields are presented to the indexer from the forwarder. If I wanted to anonymize a field named "MemberID" could I do something like this in the indexers props.conf?

[hdfax:prod]
SEDCMD-MEMID <MemberID> = s/\d+/XX-REDACTED-XX/g

Or will I have to regex _raw on the indexers /system/local/props.conf?

SEDCMD-MEMID = s/SOME_LONG_REGEX/XX-REDACTED-XX/g

This would be fine if it were not CSV or the string I wanted to anonymise had some precursor to it like MemberID=1111111. As it stands because it is csv all that exists is a structure with commas separating them.

Ugh..
JD

0 Karma
1 Solution

JDukeSplunk
Builder

Transforms.conf must be used for the extracted field, and SEDCMD for _raw.

See here for details. Waaay at the bottom.

https://answers.splunk.com/answers/739964/need-sedcmd-help.html

View solution in original post

0 Karma

JDukeSplunk
Builder

Transforms.conf must be used for the extracted field, and SEDCMD for _raw.

See here for details. Waaay at the bottom.

https://answers.splunk.com/answers/739964/need-sedcmd-help.html

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...