Help masking data and regex?

[kc_prane]

Hi All, 

Can someone please help me in masking data and regex? currently, we have an event where I need to mask certain data in a field extraction. I have already worked on the basic regex forSample1 | rex field=_raw "("PAE"\/)(?<Mask_Data>\d+\W\w+\d\s)"   but I am looking for a common or a separate regex for all the below samples and I want the events but mask the numbers before " : : " and after /  I am good I can get only the numbers masked in the tail.

EVENT Samples

1)  Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalPAE/188888/WWEE1112: :

2) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessment/188888/EEE3456823947 : :

3)Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromEEF/11111233 : :

4) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromservices/1333/11233 : :

Thanks in advance.

[VatsalJagani]

Based on the samples I'm assuming you want want to mask numbers and alphabets between / and ::.

I'm assuming there are no spaces or other characters in between them.

Write below the line in the props.conf under the right sourcetype stanza. (on the parsing instance, if you collect data on HF, put it on HF, if you collect data on UF and send it to Indexer then put it on Indexers, if you don't understand where to put I would put the configuration everywhere)

SEDCMD-maskvalues = s/\/(\w|\d)+::/\/#####::/g

This should mask the values in your event before it ingests in Splunk. Because I made some assumptions it is a good idea that you do a test before you apply it on production.

[kc_prane]

Appreciate your help on the details @VatsalJagani. yes, we do have space after the /digit"space": : but I can add "s " in the provided query. Is there a way we can use get the regex on the UI for masking?  cause I don't have access to the backend servers.

[VatsalJagani · Accepted solution]

Yes. 

| rex mode=sed "s/\/(\w|\d)+::/\/#####::/g"

VatsalJagani_0-1644992466208.png

------

@kc_prane - Please upvote and accept the solution if this answers your questions.

[kc_prane]

Thanks a lot Vatsal Jagani !