Knowledge Management

How can I use sed in Restrict search terms to sanitize on search

buckiboy
New Member

I have a task to sanitize output of the search for certain users. The data were indexed without sanitation and I cant reindex the data.

example:
index=os | rex field=_raw mode=sed 's/acl/@/'

but i am getting Error in 'litsearch' command: Unable to parse the search: unbalanced parentheses, however the sed command works fine when used in search.

from job inspector:
( index=os ) ( ( | rex field=_raw mode=sed 's/acl/@/' ) ) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

0 Karma

masonmorales
Influencer

As @somesoni2 mentioned, you can only use base search terms in the "restrict search terms" option. What you are describing is not possible in the current version of Splunk.

I would recommend that you export the events containing sensitive data (use | fields _raw at the end of your search), use the delete command to delete the sensitive events from the index, develop configs to sanitize the sensitive data (see http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Anonymizedatausingconfigurationfiles), and then re-index the data so that it will be sanitized at index time.

If your use case requires some users seeing sensitive data, and some not, I would suggest using data cloning to send the data to two separate indexes, and give them different sourcetypes, where one sourcetype has the SED and the other does not. Then, you can assign the corresponding indexes to each of your roles.

Masa
Splunk Employee
Splunk Employee
0 Karma

somesoni2
Revered Legend

Only base search terms are allowed for that attribute, whereas rex is a command.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...