Below is the sample mocked up data .I want to mask the the ones's highlighted .The sample data is part of an event which is more than 300 lines
"status": 1,
"parentGoalId": 5133,
"account": {
"goalId": 0,
"accountType": "regular",
"accountOpenDate": "0001-01-01T00:00:00",
"isAccountOpeningInProgress": true,
"owner": {
"firstName": "abc",
"middleName": "xyz",
"lastName": "eee",
"dateOfBirth": "1/1/2000 12:00:00 AM",
"ssn": "099999999",
"citizenship": "alien",
"isMailingAddressAsPhysical": false,
"isTextMessageNotificationEnabled": false,
You could probably use below link to anonymize data at index time.
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/Anonymizedata#Define_the_sed_script_in_...
and try s/(\"firstName\":\s+\")\w+/\1xxx/g
for every field. Use the same for every field just change the name in round brackets and it should work.
Before this I would recommend you to try this in search time using rex
on your prod data to see if it actually what you want.
This is sample run anywhere search
| makeresults | eval data="\"owner\": {
\"firstName\": \"abc\",
\"middleName\": \"xyz\",
\"lastName\": \"eee\",
\"dateOfBirth\": \"1/1/2000 12:00:00 AM\",
\"ssn\": \"099999999\",
\"citizenship\": \"alien\"," | rex field=data mode=sed "s/(\"firstName\":\s+\")\w+/\1xxx/g" | rex field=data mode=sed "s/(\"middleName\":\s+\")\w+/\1xxx/g"
You should use rex
command given above on your prod data and see if it is actually working.
Let me know if this helps!
You could probably use below link to anonymize data at index time.
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/Anonymizedata#Define_the_sed_script_in_...
and try s/(\"firstName\":\s+\")\w+/\1xxx/g
for every field. Use the same for every field just change the name in round brackets and it should work.
Before this I would recommend you to try this in search time using rex
on your prod data to see if it actually what you want.
This is sample run anywhere search
| makeresults | eval data="\"owner\": {
\"firstName\": \"abc\",
\"middleName\": \"xyz\",
\"lastName\": \"eee\",
\"dateOfBirth\": \"1/1/2000 12:00:00 AM\",
\"ssn\": \"099999999\",
\"citizenship\": \"alien\"," | rex field=data mode=sed "s/(\"firstName\":\s+\")\w+/\1xxx/g" | rex field=data mode=sed "s/(\"middleName\":\s+\")\w+/\1xxx/g"
You should use rex
command given above on your prod data and see if it is actually working.
Let me know if this helps!
Hello Mayurr,
Thank you for your response I tries using the rex for date of birth s/(\"dateOfBirth\":\s+\")\w+/\1xxx/g .This only masked the part before the first / like xxx/1/2000 12:00:00 AM
Try this for date of birth:
| rex field=data mode=sed "s/(\"dateOfBirth\":\s+\")[^\"]+/\1xxx/g"
Pls accept if it works for you to close this question.
Thank You it worked