Splunk Search

Unable to mask data with regex

cborchgrevink
Engager

Example Log:

CEF:0|WAF|SIEMintegration|1|1|Normal|0| fileId=989000730114151753 sourceServiceName=website.com postbody=first_name\=XXXXXX&last_name\=XXXX&shipping_first_name\=ABCDE&shipping_last_name\=EFGHI&record_number\=123412345

I am having trouble getting my regex in transforms.conf to mask:
1. shipping_first_name
2. shipping_last_name
3. record_number

Transforms.conf

[record-anonymizer]
REGEX = (?m)^(.*)record_number..\d{2,}$
FORMAT = $1rn=##
DEST_KEY = _raw

[first-name-anonymizer]
REGEX = (?m)^(.*)shipping_first_name..(\w{2,})&$
FORMAT = $1fn=##$
DEST_KEY = _raw

[last-name-anonymizer]
REGEX = (?m)^(.*)shipping_last_name..(\w{2,})&$
FORMAT = $1ln=##$
DEST_KEY = _raw

props.conf

[Test]
TRANSFORMS-anonymize = record-anonymizer, first-name-anonymizer, last-name-anonymizer
Tags (2)
0 Karma

tom_frotscher
Builder

Hi,

i tried to use your regex with regex101 and they do not match correctly. What you want, is a regex that captures everything up to the string you want to mask, and everything behind. Then, in the FORMAT field you use the first capture group, set your mask in the middle and use the secodn capture group.

Try this:

[record-anonymizer]
REGEX = (?m)^(.*)record_number\\\=\d+(.*)$
FORMAT = $1record_number=##$2
DEST_KEY = _raw

[first-name-anonymizer]
REGEX = (?m)^(.*)shipping_first_name\\\=\w+(&.*)$
FORMAT = $1shipping_first_name=##$2
DEST_KEY = _raw

[last-name-anonymizer]
REGEX = (?m)^(.*)shipping_last_name\\\=\w+(&.*)$
FORMAT = $1shipping_last_name=##$2
DEST_KEY = _raw

Greetings
Tom

pruthvikrishnap
Contributor

Try this

[my_sourctype]
[source::/path/to/my/logs]
SEDCMD-remove_secret_data = regex`enter code here
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...