Getting Data In

data masking not working at index time

kranthimutyala
Path Finder

Hi Guys,
I have the below sample data , i want to mask the string after Basic and tried below transforms.conf and sed but both didnt work.Can somepne help me with masking the string

*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n
*/*\r\nAuthorization: Basic **rxBshshhdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TdsdsskfjksfjksjgkshfjhfjhHhdjahj**==\r\n

[f5:test]
SEDCMD-anonymizeip = s/Authorization: Basic(?:\s([a-zA-Z]{0,50}==))/XXX.XXX.XXX.XXX/g

[session-anonymizer]
REGEX = (nAuthorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test1xxxxxx$2
WRITE_META = true
DEST_KEY = _raw

[ticket-anonymizer]
REGEX = (Proxy-Authorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test2xxxxxxx$2
WRITE_META = true
DEST_KEY = _raw
0 Karma

damann
Communicator

As FrankVI already mentioned your SED regex doesnt match your sample events.

I played a little around with SED and came to this solution:

echo "*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n" |  sed 's/\(Basic\s\*\*\)\([a-zA-Z]*\)/\1XXX/g'

This outputs to

*/*\r\nAuthorization: Basic **XXX**==\r\Proxy-Authorization: Basic **XXX**==\r\n

I hope it helps

0 Karma

FrankVl
Ultra Champion

Regarding the SED command:
Do your events actually contain those plain \r\n strings and also the ** bits?

If so, your SED regex does not match. If not, please clarify your sample events.

Also: keep in mind that the SED command replaces the entire string that matches with the XXX pattern. So it not only masks what is in the capture group, but also the "Authorization: Basic" before it.

Regarding the transforms:
The regex is invalid, (?\w+) is not valid REGEX syntax.
Not sure what exactly you are trying to do here, but overwriting the whole _raw in this way probably destroys most of your event content. (if it wasn't for the broken regex syntax, that prevents this bit from being applied altogether).

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...