Hi all,
I have the following data being indexed by splunk:
POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=
I have the following in /opt/splunk/etc/system/local/transforms.conf
[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw
and ./props.conf
[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer
As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m)
being multiline would handle this.
Thanks!
It is easier to use SEDCMD
in the props.conf file than using TRANSFORMS
and a transforms.conf file. Here is what I would do:
props.conf:
SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic ###########REDACTED###########/g
That will do multiple instances and it only has to be done in one file instead of two.
It is easier to use SEDCMD
in the props.conf file than using TRANSFORMS
and a transforms.conf file. Here is what I would do:
props.conf:
SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic ###########REDACTED###########/g
That will do multiple instances and it only has to be done in one file instead of two.
will test this out. thx!