Splunk Search

Splunk-reskit-powershell Query Masking Data

MrMalice
Explorer

I am trying to identify if events have password info in the returned events. I can run a query using the Search app and it returns the data that I am looking for. I visually examine the_raw output listing for the word 'password'. When I execute the same query using splunk-reskit-powershell the data is returned, however, the word 'password' is replaced with a ',' comma in the _raw data listing.

The syntax of my query is in the form of : index= sourcetype= 'password'

I use preset times when using the gui and startime and endtime when using powershell.

Is there a way to prevent the data from being replaced in my output from the powershell query?

Tags (1)
0 Karma
1 Solution

MrMalice
Explorer

I was unable to determine why the results from my search didn't include the search phrase from my search.
Example: index="main" sourcetype="splunkd" "FooFoo"
In my example the results in the_raw field would return all of the events without the word FooFoo in them.

In order to get around this anomaly I piped the predicate out to regex.
index="main" sourcetype="splunkd" | regex _raw = "FooFoo"

This returned all events along with the word "FooFoo" present in the result set.

View solution in original post

0 Karma

MrMalice
Explorer

I was unable to determine why the results from my search didn't include the search phrase from my search.
Example: index="main" sourcetype="splunkd" "FooFoo"
In my example the results in the_raw field would return all of the events without the word FooFoo in them.

In order to get around this anomaly I piped the predicate out to regex.
index="main" sourcetype="splunkd" | regex _raw = "FooFoo"

This returned all events along with the word "FooFoo" present in the result set.

0 Karma

MrMalice
Explorer

I've found that the results returned from my query will hide the word being searched on regardless of if it says 'password' or not. When I use the -expandproperty option on the raw field it totally removes the word being searched for from the result set. If I don't use the -expandproperty option then it replaces my search string with a ',' comma.
Since this problem seems to be bigger than my initial question that I posed, I'm going to close this question and get the latest version of the kit from GitHub. I hope that resolves this issue.

Regards,
M

0 Karma

MrMalice
Explorer

The editor changed the context of my example.
It should read:
The syntax of my query is in the form of : index= "index_name" sourcetype="sourcetype_name" 'password'

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...