Getting Data In

Apply SEDCMD to mutli line events in props.conf with recurring field values

Raghav2384
Motivator

Hello Experts,

I have been asked to hash out one occurrence of value_key from the following logs. I have tried the following in props.conf on indexer

[default]
SEDCMD-hash = s/value_key:(\S+), code_key:PASSWORD/XXXXXX/g

and restarted splunk and instead of hiding it, it deleted all the events that contained value_key. When i try the same in search i get what i want

*****15 lines *******
[value_key:xyzabcd.click.net, code_key:USER_NAME]
        [value_key:**needtohidethispassword**, code_key:PASSWORD]
        [value_key:BHN-1click, code_key:DOMAIN]
        [value_key:46793, code_key:PORT_NUMBER]
        [value_key:1.2.3.4, code_key:ISG_IP]
        [value_key:ISG, code_key:type]
*****15 Lines*********

I know it has to be index time extraction only. Do i need a corresponding transforms.conf to define the class or can i acheive it solely using props.conf? if so, could you please provide syntax/tips?

Thanks,
Raghav

Tags (2)
0 Karma

ludoz13
Path Finder

Hello,

could you test this :

SEDCMD-hash = s/(.value_key:)([^\,]+)(, code_key:PASSWORD.)/\1XXXXXX\3/g

I hope it will help you

Raghav2384
Motivator

I got the same result as using

SEDCMD-hash = s/value_key:(\S+), code_key:PASSWORD/XXXXXX/g. Instead of

value_key:XXXXXX, code_key:PASSWORD , it replaces the whole line with [XXXXXX]. It started to make sense as this is happening at index time before the event boundaries are marked, or i might have missed the point totally.

Appreciate your help.
Thanks,
Raghav

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you want this to happen for all sourcetypes OR one particular sourcetype (asking as you created this entry in [default] stanza)?

Raghav2384
Motivator

I tried
[Sourcetype]
Sedcmd-xyz = s/regex/####/g and no luck.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...