Splunk Search

Can you mask data at index-time conditionally?

twinspop
Influencer

Given data like this:

v1=1 v2=2 v3=3.45 v4=4 key=bad
v1=6 v2=7 v3=8.45 key=good v4=9

I want to mask the vX values in the case of key=bad only. I cannot guarantee order. Results should be:

v1=x.xx v2=x.xx v3=x.xx v4=x.xx key=bad
v1=6 v2=7 v3=8.45 key=good v4=9

Is this possible?

alemarzu
Motivator

Hi twinspop,

Try to follow this example using your sample data.

01/19/2016 11:34 v1=1 v2=2 v3=3.45 v4=4 key=bad
01/19/2016 11:22 v1=6 v2=7 v3=8.45 key=good v4=9

With the given SEDCMD regex below, using Positives Lookbehind/Lookahead.

[your_sourcetype]
SEDCMD = s/(?<=v1=).*(?=\sv2=.*?\skey=bad)/X.XX/g s/(?<=v2=).*(?=\sv3=.*?\sv4=.*?\skey=bad)/X.XX/g s/(?<=v3=).*(?=\sv4=.*?\skey=bad)/X.XX/g s/(?<=v4=)\d(?=\skey=bad)/X.XX/g

Hope it helps.

0 Karma

twinspop
Influencer

This might lead to the correct way, but the field names (aside from key) are variable. I should have included that tidbit. 🙂 Reading up on PLBs and PLAs. Thanks!

0 Karma

twinspop
Influencer

I'm not able to make this work because the fields that need masking occur an arbitrary number of times. Roughly speaking what I need is:

if (/key=bad/)
    s/v(\d+)=\d+\.\d{2}/v\1=x.xx/g

(this will teach me to use better sample data -- sorry)

0 Karma

alemarzu
Motivator

It's okey mate, dont worry about it.

Check this out, based on your sample data again, this regex should match (n) amount of fields.

s/(?<==)(\d+\.\d{1,}+|\d+)(?=.*?key=bad)/X.XX/g

EDIT: regex101 example, https://regex101.com/r/uM9nW8/1

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...