Splunk Search

How do you handle multiple sanitizations in the same regex?

zhatsispgx
Path Finder

Hi all,

I have the following data being indexed by splunk:

POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=

I have the following in /opt/splunk/etc/system/local/transforms.conf

[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw

and ./props.conf

[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer

As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m) being multiline would handle this.

Thanks!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

0 Karma

zhatsispgx
Path Finder

will test this out. thx!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...