Hi, I have the below event in my splunk logs and i want to partially mask few things -
1. I want to just remove the IP's which is at the end of 2nd line - 12.12.12.12
2. I want to partially mask the digits in between from this - number: 441234567809. Like 44******809.
And i want to do this in _raw events because i will be exporting the _raw file from Splunk after masking
--5f72c-A--
[21/May/2019:23:55:01 +0100] dffsdfsdfds129.654.234.92 5666 12.12.12.12
--5472c-B--
GET /testHTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip
User-Agent: okhttp/3.10.0
number: 441234567809
Can someone please guide how to do this using sed command?
All this is part of single event? Do you want to mask the data at index time OR search time?
Hi,
If you want to mask data at search time you can use below regex.
<yoursearch>
| rex field=_raw mode=sed "s/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\v)/\1/"
| rex field=_raw mode=sed "s/(number\:\s\d{2})\d+(\d{3})/\1***\2/"
Just to add on to the above :
I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line -
| rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g"