Replace _raw data for the matched string pattern in a multiple lines raw data

[dwangfeng]

Here is my raw data in the splunk query

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"> <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <application xmlns="http://www.abc.com/services/listService"> <header> <user>def@ghi.com</user> <password>al3yu2430nald</password>

If I want to mask the password value and show in the splunk output as:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"> <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <application xmlns="http://www.abc.com/services/listService"> <header> <user>def@ghi.com</user> <password>xxxxxxxxxxxx</password>

How can I do that?

[kiran_panchavat]

@dwangfeng 

Apply this props.conf 

[<sourcetype>]
SEDCMD-splunktestdata = s/(?i)(<password>)[^<]+(<\/password>)/\1xxxxxxxxxxxx\2/g

[kiran_panchavat · Accepted solution]

@dwangfeng 

index="yourindex" sourcetype="yoursourcetype"
| rex mode=sed "s/<password>[^<]+<\/password>/<password>xxxxxxxxxxxx<\/password>/g"

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Please, don't forget to accept this solution if it fits your needs.

[isoutamo]

Hi

even you can mask that data in GUI, it didn't mean that you have really masked that data in Splunk. You must remember that after you have write it into bucket then it there and there is always a way to get it out in plain text if/when you have access to GUI and can write SPL. Even you are using search time props.conf and transforms.conf.

The only way is remove that data from index and reindex it again. And even the delete command is not enough if you have access to buckets on CLI level, you could get thet data back. The only way is let it go away with set frozen time enough low, then wait and then reindex it.

r. Ismo

[dwangfeng]

Thank you @kiran_panchavat . your solution works great.

[kiran_panchavat]

@dwangfeng Can you try this 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Please, don't forget to accept this solution if it fits your needs.