Splunk Search

How do you handle multiple sanitizations in the same regex?

zhatsispgx
Path Finder

Hi all,

I have the following data being indexed by splunk:

POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=

I have the following in /opt/splunk/etc/system/local/transforms.conf

[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw

and ./props.conf

[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer

As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m) being multiline would handle this.

Thanks!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

0 Karma

zhatsispgx
Path Finder

will test this out. thx!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...