Getting Data In

masking password with rex command

moin140586
New Member

hi i have a data where there are two fields with password which i need to mask via props.conf and also in the search.

the data looks like this : "this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."

rex field=_raw mode=sed "s/abc\.password=\w+/abc.password=XXXXXXXX/g"

i was trying my luck in the search first. i cannot do the masking in single rex sed command for both the passwords . i was able to do sucessfully for first one as its not having special characters.

Regards,

Moin

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @moin140586,

in your regex I see that you didin't escaped "=", anyway, try something like this:

| makeresults 
| eval _raw="this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."
| rex mode=sed "s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g"

The regex can be used also in props.conf:

SEDCMD-anonymize = s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g

If you can share a sample of your logs I could be more precise.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...