Splunk Search

Unable to mask data using regex expression in XML logfile

mookiie2005
Communicator

I need to mask WILLIAM as seen below:

2015-03-18 10:04:37,453 [WebContainer : 1] INFO  com.farmers.ffq.saq.service.SAQService  - Req for 97995437 Quote: <com.farmers.ffq.saq.webservice.PrefillProspectDataForAutoQuote>
  <requestHeader>
    <userId>FFQ138</userId>
    <functionName>0</functionName>
  </requestHeader>
  <isBILimitSelected>false</isBILimitSelected>
  <isCurrentCarrierSelected>false</isCurrentCarrierSelected>
  <isPDLimitSelected>false</isPDLimitSelected>
  <numberOfCacheDays>-1</numberOfCacheDays>
  <prospectCustomer>
   <firstName>WILLIAM</firstName>

I have been trying to use this regex in my transforms.conf:

[FirstName-anonymizer]
REGEX = (?ms)^(.\*)\<[fF]irstName>\d{1,10}.\*)$
FORMAT = $1##########$2
DEST_KEY = _raw

however, the output from the above eliminates all other data for the record so in Splunk, all you will see for each event is:

$1<firstName>########<firstName>$2

The above was based on the example from:

http://answers.splunk.com/answers/73298/masking-ssn-info-into-splunk-at-index-time.html

I have also looked at:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Anonymizedatausingconfigurationfiles

Can anyone help?

0 Karma
1 Solution

vincenteous
Communicator

Hi mookiie,

Have you tried your regex pattern at an online regex tester before you applied it to your Splunk configuration? I've tried using your regex pattern with your sample data and I found an error for your pattern [you have ')' before '$', but no '(' to make a complete bracket].

I tried to make a new pattern for your sample data:

(?ms)^(.*\<[fF]irstName\>)\w+(.*)$

Hope it helps.

View solution in original post

vincenteous
Communicator

Hi mookiie,

Have you tried your regex pattern at an online regex tester before you applied it to your Splunk configuration? I've tried using your regex pattern with your sample data and I found an error for your pattern [you have ')' before '$', but no '(' to make a complete bracket].

I tried to make a new pattern for your sample data:

(?ms)^(.*\<[fF]irstName\>)\w+(.*)$

Hope it helps.

mookiie2005
Communicator

Thank you so much! This is the first time we have tried to mask data and it was driving me nutz! Again thank you for taking the time to help out a fellow splunker!

0 Karma

vincenteous
Communicator

No problem. Glad to be of any help 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...