Hello,
I have events with two extracted fields with values that I'd like to mask partially at search time. Here are the two sample field values:
AccountID=987654321
SSN=123-45-6789
When I entered the following search command, the result showed with AccountID=XXXXXXXX and SSN=XXXXXXXX; both values are completely masked with XXXXXXXX.
sourcetype=MyTest | table _time First_Name Last_Name AccountID SSN | eval AccountID = "XXXXXXXX" | eval SSN = "XXXXXXXX"
However, I'd like the result to show only the last 4 digits of the AccountID and SSN. For example, I'd like the result to show AccountID=XXXXX4321 and SSN=XXX-XX-6789. How would I construct a search to do that and also test for an empty/null value and put a static text "NONE" if the value is empty/null?
Thank you.
You can try this...
sourcetype=MyTest| eval SSN=if(isnull(SSN),"NONE",SSN) | rex field=SSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"| table _time First_Name Last_Name AccountID SSN
You can try this...
sourcetype=MyTest| eval SSN=if(isnull(SSN),"NONE",SSN) | rex field=SSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"| table _time First_Name Last_Name AccountID SSN
Thanks esix_splunk! It worked!
Hi,
You can use rex and sed to do a match and replace. Check out rex syntax.
Eg:
sourcetype=MyTest|rex field=SSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"| table _time First_Name Last_Name AccountID SSN
should mask SSN in the search results. If your AccountId follows a fixed pattern.. you can do the same.
Thanks Yasaswy! It worked! Any suggestion on how to test for an empty/null value and put a static text "NONE" if the value is empty/null?