Splunk Search

search time data masking

Motivator

Hi

I am trying to mask indexed data using following props.conf comfig for linux_secure.

[linux_secure]
EXTRACT-ip = (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
EVAL-ip = md5(ip)
EVAL-_raw = replace(_raw,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})",ip)

I try to mask IP address and replace the IP address with hashed value(mp5), but replacement portion does not work with the config above. Still ip address in raw event is not hashed.

alt text

The desired _raw and ip field look like this:

alt text

Does anyone know how to configure props.conf to replace ip raw data into hashed ip data?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You cant overwrite _raw at search time with EXTRACT or REPORT. Only through spl in the eval method you're using.

http://answers.splunk.com/answers/3025/search-time-mask.html
http://answers.splunk.com/answers/26137/how-can-i-mask-data-both-at-index-time-and-search-time.html

Other options would be either a macro, or mask this at index time with SEDCMD.

View solution in original post

Splunk Employee
Splunk Employee

You cant overwrite _raw at search time with EXTRACT or REPORT. Only through spl in the eval method you're using.

http://answers.splunk.com/answers/3025/search-time-mask.html
http://answers.splunk.com/answers/26137/how-can-i-mask-data-both-at-index-time-and-search-time.html

Other options would be either a macro, or mask this at index time with SEDCMD.

View solution in original post

Motivator

esix, thank you for your commend.

After several trials and errors, I ended up with the config below.
This works for me.

[linux_secure]
EXTRACT-ip1 = (?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
EVAL-_raw = replace(_raw,"(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})",md5(ip))
EVAL-ip = md5(ip)

I am looking for the way to hide ip by using _ip as a field name.
Thanks!

Communicator

This worked great for us as well, thank you for sharing.

0 Karma