How do I partially mask or anonymize a field value at search time?

[flee]

Hello,

I have events with two extracted fields with values that I'd like to mask partially at search time. Here are the two sample field values:
AccountID=987654321
SSN=123-45-6789

When I entered the following search command, the result showed with AccountID=XXXXXXXX and SSN=XXXXXXXX; both values are completely masked with XXXXXXXX.

sourcetype=MyTest | table _time First_Name Last_Name AccountID SSN | eval AccountID = "XXXXXXXX" | eval SSN = "XXXXXXXX"

However, I'd like the result to show only the last 4 digits of the AccountID and SSN. For example, I'd like the result to show AccountID=XXXXX4321 and SSN=XXX-XX-6789. How would I construct a search to do that and also test for an empty/null value and put a static text "NONE" if the value is empty/null?

Thank you.

[esix_splunk · Accepted solution]

You can try this...

sourcetype=MyTest| eval SSN=if(isnull(SSN),"NONE",SSN) | rex field=SSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"| table _time First_Name Last_Name AccountID SSN

[flee]

Thanks esix_splunk! It worked!

[Yasaswy]

Hi,
You can use rex and sed to do a match and replace. Check out rex syntax.
Eg:

sourcetype=MyTest|rex field=SSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"| table _time First_Name Last_Name AccountID SSN

should mask SSN in the search results. If your AccountId follows a fixed pattern.. you can do the same.

[flee]

Thanks Yasaswy! It worked! Any suggestion on how to test for an empty/null value and put a static text "NONE" if the value is empty/null?