Getting Data In

Anonymize data is not working,

ahmadjabr
Engager

hello,

I made my Anonymize data based on this http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata
and I checked it million times.
I have distributed installation and I have done this on "indexer"

[xyz:abc:auto]
TRANSFORMS-anonymize = password-anonymizer

[password-anonymizer]
REGEX = (?m)^(.)Password=\w+%(\w{0}[^&].)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Tags (1)
0 Karma

Yunagi
Communicator

Try the following changes:

[password-anonymizer]
REGEX = (?m)^(.*)Password=[^%]*(.*)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Please note that this configuration belongs into transforms.conf. The other two lines you posted belong into props.conf.

You will need to restart your indexers after making such changes.

Also make sure that your data has the correct sourcetype assigned. (In your case, that would be "xyz:abc:auto".)

On a more general note, I often use this website for testing purposes when dealing with regex:
https://regex101.com/

0 Karma

ahmadjabr
Engager

I found out that the indexer doesn't even do anything with the log, it's like it doesn't read the stanza I made.
and I moved it to the top but its the same nothing happened

0 Karma

Yunagi
Communicator

Run the following commands on your indexer to check that Splunk finds your configuration:
/opt/splunk/bin/splunk btool props list
/opt/splunk/bin/splunk btool transforms list
Is your configuration listed here?

Which sourcetype does your data have? If the props.conf stanza is [xyz:abc:auto] as you posted then the sourcetype of your data must be "xyz:abc:auto".

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ahmadjabr,
can you share an example of log to anonymize, your regex isnot so clear?
Bye.
giuseppe

0 Karma

ahmadjabr
Engager

2017-12-18 07:42:19 10.0.1.1 GET /send.asmx/Send Username=CENTER&Password=asdqweasd%23&Sender=xyyzetc etcetcetectecetetctec

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ahmadjabr,
try a different regex escaping = and %

REGEX = (?m)^.*Password\=\w+\%.*$

Bye.
Giuseppe

0 Karma

Yunagi
Communicator

The link you provided says: "The forwarded data must arrive at the indexer already parsed." Do you perhaps have a heavy forwarder in place?

If you have a heavy forwarder in place, move your anonymization configuration from the indexers to the heavy forwarders.

0 Karma

ahmadjabr
Engager

I don't have heavy forwarder I have universal forwarder, will it work?
and universal forwarder on the windows machine

0 Karma

Yunagi
Communicator

Universal forwarders do not parse the data. So keep this configuration on the indexers.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...