Getting Data In

sedcmd for part of the string in props.conf

New Member

I need to anonymize ES credentials going to syslog
I need to redact only the password and leave the user name -u admin:passsword
like -u [^:]:[^\s]

Can I use sedcmd for this .

I see samples if value of admin is fixed. Need to leave that value.

Thanks in advance.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this run anywhere search

| makeresults 
| eval _raw="user name -u nathanpaul8:xczveffd" 
| rex field=_raw mode=sed "s/(-u\s[^\:]+\:)([^\s]+)/\1XXXXX/g"

In props.conf on indexer/heavy forwarder, you need to put

[<your_sourcetype>]
SEDCMD-password = s/(-u\s[^\:]+\:)([^\s]+)/\1XXXXX/g

let me know if this helps!

View solution in original post

New Member

Thanks to both.

0 Karma

SplunkTrust
SplunkTrust

Try this run anywhere search

| makeresults 
| eval _raw="user name -u nathanpaul8:xczveffd" 
| rex field=_raw mode=sed "s/(-u\s[^\:]+\:)([^\s]+)/\1XXXXX/g"

In props.conf on indexer/heavy forwarder, you need to put

[<your_sourcetype>]
SEDCMD-password = s/(-u\s[^\:]+\:)([^\s]+)/\1XXXXX/g

let me know if this helps!

View solution in original post

Super Champion

Try this:
in props.conf on Indexer/Heavy Forwarder

[sourcetype]
 SEDCMD-cc = s/(?i)(-u\s[^\:]+\:)\w+/\1xxxxxxx/g
0 Karma

New Member

Thanks to both. realized I am using another TRANSFORMER for the same source. . started managing splunk couple of months ago. Can I use both TRANSORMER and sedcmd?.

0 Karma

Super Champion
0 Karma