Hi, I want to mask just specific values. This is an example of a json event return in splunk : {"MemorySize": 256, "region": "ca-central-1", "TracingConfig": \{"Mode": "PassThrough"\}, "Revisi...
See more...
Hi, I want to mask just specific values. This is an example of a json event return in splunk : {"MemorySize": 256, "region": "ca-central-1", "TracingConfig": \{"Mode": "PassThrough"\}, "RevisionId": "777", "Handler": "handleRequest", "Timeout": 600, "LastModified": "2020-05-27T14:05:43.839+0000", "Environment": \{"Variables": \{"ENVIRONMENT": "dev", "USER": "username", "USERPASSD": "password", \}\}, "Role": "arn:aws:iam::666:role/X", "VpcConfig": \{"SubnetIds": ["subnet-000", "subnet-111"], "VpcId": "vpc-333", "SecurityGroupIds": ["sg-444"]\}, "CodeSize": 5555, "Description": "Lambda", "Runtime": "java11", "Version": "$LATEST"\}} The problem is that sensitive data appear in clear specifically in Environment>Variables In this section, we have variables : the data are not the same in each event, we can not create a regex with specific key name because it always changes. How can I mask all values in the Environment>Variables WITHOUT masking the key ? Example of result I want : {"MemorySize": 256, "region": "ca-central-1", "TracingConfig": \{"Mode": "PassThrough"\}, "RevisionId": "777", "Handler": "handleRequest", "Timeout": 600, "LastModified": "2020-05-27T14:05:43.839+0000", "Environment": \{"Variables": \{"ENVIRONMENT": XXXXXX, "USER": XXXXXX, "USERPASSD": XXXXXX, \}\}, "Role": "arn:aws:iam::666:role/X", "VpcConfig": \{"SubnetIds": ["subnet-000", "subnet-111"], "VpcId": "vpc-333", "SecurityGroupIds": ["sg-444"]\}, "CodeSize": 5555, "Description": "Lambda", "Runtime": "java11", "Version": "$LATEST"\}} I tried a props.conf like that : [sourcetype] INDEXED_EXTRACTION = json KV_MODE = none EXTRACT-var = \{\"Variables\"\:\s*\\\{(?<Variables>[^\}]+)\\ TRANSFORMS-anony = anony_raw and a transforms.conf : [anony_raw] REGEX = s/(\s*\"\s*[^\"]*\"[^\"]*\"([^\"]*)\s*\"\s*\,*)+ FORMAT = $1XXXXXX DEST_KEY =_meta SOURCE_KEY =_meta But it doesn't work at all... Can you help me ?