Splunk Search

Help masking data and regex?

kc_prane
Path Finder

Hi All, 

Can someone please help me in masking data and regex? currently, we have an event where I need to mask certain data in a field extraction. I have already worked on the basic regex forSample1 | rex field=_raw "("PAE"\/)(?<Mask_Data>\d+\W\w+\d\s)"   but I am looking for a common or a separate regex for all the below samples and I want the events but mask the numbers before " : : " and after /  I am good I can get only the numbers masked in the tail.

 

EVENT Samples

1)  Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalPAE/188888/WWEE1112: :

2) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessment/188888/EEE3456823947 : :

3)Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromEEF/11111233 : :

4) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromservices/1333/11233 : :

Thanks in advance.

Labels (2)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Yes. 

 

| rex mode=sed "s/\/(\w|\d)+::/\/#####::/g"

 

VatsalJagani_0-1644992466208.png

------

@kc_prane - Please upvote and accept the solution if this answers your questions.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Based on the samples I'm assuming you want want to mask numbers and alphabets between / and ::.

I'm assuming there are no spaces or other characters in between them.

Write below the line in the props.conf under the right sourcetype stanza. (on the parsing instance, if you collect data on HF, put it on HF, if you collect data on UF and send it to Indexer then put it on Indexers, if you don't understand where to put I would put the configuration everywhere)

SEDCMD-maskvalues = s/\/(\w|\d)+::/\/#####::/g

 

This should mask the values in your event before it ingests in Splunk. Because I made some assumptions it is a good idea that you do a test before you apply it on production.

0 Karma

kc_prane
Path Finder

Appreciate your help on the details @VatsalJagani. yes, we do have space after the /digit"space": : but I can add "s " in the provided query. Is there a way we can use get the regex on the UI for masking?  cause I don't have access to the backend servers.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yes. 

 

| rex mode=sed "s/\/(\w|\d)+::/\/#####::/g"

 

VatsalJagani_0-1644992466208.png

------

@kc_prane - Please upvote and accept the solution if this answers your questions.

0 Karma

kc_prane
Path Finder

Thanks a lot Vatsal Jagani !

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...