Getting Data In

SEDCMD not being applied?

jdmclemore
Path Finder

I'm trying to do a seemingly simple SEDCMD replace of passwords in logs, but nothing is getting applied. I have pushed props.conf out to all the indexers in my cluster, but looking at new data nothing gets changed. Am I doing something wrong?

Sample log (sourcetype=access_log):
10.1.1.1 - - [09/May/2017:16:42:52 -0500] [GET /service/auth/login?user_name=JoeUser&password=realpassword HTTP/1.1] 200 2315 Cnt-Type=- Acc=- Resp-Cnt-Type=application/xml

Expected result:
10.1.1.1 - - [09/May/2017:16:42:52 -0500] [GET /service/auth/login?user_name=JoeUser&password=xxxxx HTTP/1.1] 200 2315 Cnt-Type=- Acc=- Resp-Cnt-Type=application/xml

In props.conf:

    [access_log]
    SEDCMD-replacepasswd = s/password=.+\s/password=xxxxx\s/g
Tags (1)
0 Karma
1 Solution

MuS
Legend

Also worth to mention that this must be on the parsing layer, so if there are heavy weight forwarder along the data pipe it must be put on them, see the docs for details about this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline#P...

cheers, MuS

View solution in original post

MuS
Legend

Also worth to mention that this must be on the parsing layer, so if there are heavy weight forwarder along the data pipe it must be put on them, see the docs for details about this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline#P...

cheers, MuS

jdmclemore
Path Finder

Thanks Mus - that did the trick. I included my SEDCMD stanza in a props.conf that gets distributed to my intermediate Heavy Forwarders and all is good.

0 Karma

jdmclemore
Path Finder

Ah, that may be it - I do use Heavy Forwarders as my intermediate forwarders. I'll push props.conf out to them and report back.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the indexers after modifying props.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...