Splunk Search

How do you handle multiple sanitizations in the same regex?

zhatsispgx
Path Finder

Hi all,

I have the following data being indexed by splunk:

POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=

I have the following in /opt/splunk/etc/system/local/transforms.conf

[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw

and ./props.conf

[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer

As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m) being multiline would handle this.

Thanks!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

0 Karma

zhatsispgx
Path Finder

will test this out. thx!

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...