Splunk Search

How do you handle multiple sanitizations in the same regex?

zhatsispgx
Path Finder

Hi all,

I have the following data being indexed by splunk:

POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=

I have the following in /opt/splunk/etc/system/local/transforms.conf

[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw

and ./props.conf

[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer

As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m) being multiline would handle this.

Thanks!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

0 Karma

zhatsispgx
Path Finder

will test this out. thx!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...