Getting Data In

masking password with rex command

moin140586
New Member

hi i have a data where there are two fields with password which i need to mask via props.conf and also in the search.

the data looks like this : "this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."

rex field=_raw mode=sed "s/abc\.password=\w+/abc.password=XXXXXXXX/g"

i was trying my luck in the search first. i cannot do the masking in single rex sed command for both the passwords . i was able to do sucessfully for first one as its not having special characters.

Regards,

Moin

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @moin140586,

in your regex I see that you didin't escaped "=", anyway, try something like this:

| makeresults 
| eval _raw="this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."
| rex mode=sed "s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g"

The regex can be used also in props.conf:

SEDCMD-anonymize = s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g

If you can share a sample of your logs I could be more precise.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...