Splunk Search

Help with JSON regex replace

ballen1
Explorer

Command:

rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

Regex seems to work fine in Regex101 

However, I seem to continue to get this error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'.

I'm trying to mask a json key:value pair.  See below:

"name": "john doe" ----> "name": "######"
Labels (1)
0 Karma

danielcj
Communicator

Hello,

It is missing a after the name and before the ".

The correct one is:

| rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g"

ballen1
Explorer

Thank you for this.  For some reason I had to add a few more \ to make this work.  See below:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

0 Karma

ballen1
Explorer

Hello,

Thank you for the reply.  That removed that error.  However, it still doesn't mask the "name" field in the search.

"name" still shows as:  

"name": "john doe"

 

0 Karma

ballen1
Explorer

ah.  I figured it out.  I had to modify it like the following for it to replace properly:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

This is using splunk cloud btw.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...