About ballen1

ballen1 · ‎07-05-2022

Thank you. On the left hand side, i have SEDCMD-maskusername. Based on what i have read, this should mask things at index time. Which it has. However, is my regex off? At times when it masks the data, it pulls in the \"user_name\":"\xxxxxx\" and i'm not quite sure why it's doing that.

ballen1 · ‎07-01-2022

Thank you for this. I've added: s/\"user_name\"\:\"[^\"]+\"/\"user_name\":\"###############\"/g into the "edit source type" advanced section and it doesn't appear to mask the values as expected. Is there something wrong with my regex here? I tested it in the search&reporting section and it works there but at index time it doesn't appear t work. Also, would it be an better option to place this in the Settings->Fields->Field Transformations section?

ballen1 · ‎07-01-2022

Thank you for this. For some reason I had to add a few more \ to make this work. See below: “s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

ballen1 · ‎06-30-2022

Currently we use splunk cloud. I've added the following into the advanced section of the "Edit Source Type" to mask some fields coming in from auth0: s/\"user_name\"\:\"[^\"]+\"/\"user_name\":\"###############\"/g However, while this masks the data in the _raw json, it doesn't appear to mask the data in the data.user_name event dropdown. See below: data.user_name john doe ########## My question is, is a heavy forwarder setup necessary to mask this data in the events as well? Thank you.

ballen1 · ‎06-30-2022

ah. I figured it out. I had to modify it like the following for it to replace properly: “s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g" This is using splunk cloud btw.

ballen1 · ‎06-30-2022

Hello, Thank you for the reply. That removed that error. However, it still doesn't mask the "name" field in the search. "name" still shows as: "name": "john doe"

ballen1 · ‎06-29-2022

Is this still a valid fix? I've tried something very similar and it didn't work for me. Please see below: rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

ballen1 · ‎06-29-2022

Command: rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g" Regex seems to work fine in Regex101 However, I seem to continue to get this error: Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'. I'm trying to mask a json key:value pair. See below: "name": "john doe" ----> "name": "######"

Posts	8
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎06-29-2022

Online Status	Offline
Date Last Visited	‎07-05-2022 10:30 PM

Is heavy forwarder required for masking data in Sp...

Help with JSON regex replace

Re: Is heavy forwarder required for masking data i...

Re: Is heavy forwarder required for masking data i...

Re: Help with JSON regex replace

Is heavy forwarder required for masking data in Sp...

Re: Help with JSON regex replace

Re: Help with JSON regex replace

Re: Why does my sed replace command replace too mu...

Help with JSON regex replace