Splunk Search
Highlighted

Why are Props & transforms not taking effect when trying to hide ipclient?

Explorer

Hello community,

I am trying to configure my props.conf and transforms.conf to hide ipclient when indexing data. I am doing all the configurations needed, but I find no effect after indexation. And I can't find my hidden values :

NB : I am indexing in a specific app in my project, and I've added in props and transform in the local file of this app, And I am choosing accesscombined in the sourcetype when indexing data.

Here's my props.conf :

[access_combined]
TRANSFORMS-clientipindex = maskip_index

And here's my transforms.conf :

[maskip_index]
FORMAT = clientip_hidden::$1.".".$2.".x.x"     <= Here I am trying to hide the last two numbers of the ip address.
REGEX = ^([0-9]{1,3})\.([^.]*)\.([^.]*)\.([^.]*)
SOURCE_KEY = clientip

Any help please 😄 !

0 Karma
Highlighted

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

Motivator

Can you provide some redacted events to see if the issue is with regex. Thx..

0 Karma
Highlighted

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

Ultra Champion

You are doing a TRANSFORMS on SOURCE_KEY 'clientip'. I don't think that is available as a field at indextime. And anyway such a transforms would not change the raw event, so the ip address would still be fully visible there.

You are probably better off doing a SEDCMD in props.conf (assuming you have the client ip right at the start of your logs, as usual with access_combined I believe).

SEDCMD-mask_ip = s/^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}/\1.\2.x.x/

View solution in original post

Highlighted

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

Explorer

You are amazing FrankVl :D...Thank youuuu

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.