Knowledge Management

How can I use sed in Restrict search terms to sanitize on search

buckiboy
New Member

I have a task to sanitize output of the search for certain users. The data were indexed without sanitation and I cant reindex the data.

example:
index=os | rex field=_raw mode=sed 's/acl/@/'

but i am getting Error in 'litsearch' command: Unable to parse the search: unbalanced parentheses, however the sed command works fine when used in search.

from job inspector:
( index=os ) ( ( | rex field=_raw mode=sed 's/acl/@/' ) ) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

0 Karma

masonmorales
Influencer

As @somesoni2 mentioned, you can only use base search terms in the "restrict search terms" option. What you are describing is not possible in the current version of Splunk.

I would recommend that you export the events containing sensitive data (use | fields _raw at the end of your search), use the delete command to delete the sensitive events from the index, develop configs to sanitize the sensitive data (see http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Anonymizedatausingconfigurationfiles), and then re-index the data so that it will be sanitized at index time.

If your use case requires some users seeing sensitive data, and some not, I would suggest using data cloning to send the data to two separate indexes, and give them different sourcetypes, where one sourcetype has the SED and the other does not. Then, you can assign the corresponding indexes to each of your roles.

Masa
Splunk Employee
Splunk Employee
0 Karma

somesoni2
Revered Legend

Only base search terms are allowed for that attribute, whereas rex is a command.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...