Regex for Masking Data in a JSON Array

Question

I've got a requirement to mask the incoming JSON request inside an array using regular expression on Splunk indexer. The JSON data looks like this:

{"Name":["Jobs","Bill"]}

I'm expected to mask the incoming data so that it looks like this:

{"Name":["******","******"]}

And the regex I'm using to mask the data looks something like this:

s/\"Name\":\"[^"]*\"/"Name":"******"/g

But for some reason I'm unable to mask the JSON data. Could any of you good folks please help?

This makes no sense. I'd suggest to read this: [Can I encrypt my JSON data?](https://stackoverflow.com/questions/14570831/can-i-encrypt-my-json-data) — Maciej Los, Oct 07 '20 at 06:56
@MaciejLos, I skimmed through the link you've provided, but that isn't of much help in my case :( — adymanav, Oct 07 '20 at 07:02

score 2 · Accepted Answer · answered Oct 07 '20 at 07:59

You can use

s/(?:\G(?!^)\",|\"Name\":\[)\"\K[^\"]*/******/g

To support escaped \", use

s/(?:\G(?!^)\",|\"Name\":\[)\"\K[^\"\\]*(?:\\.[^\"\\]*)*/******/g

Details

(?:\G(?!^)\",|\"Name\":\[) - either the end of the previous match and then ", substring, or "Name":[ substring
\" - " char
\K - match reset operator discarding all text matched so far
[^\"]* - any zero or more chars other than ".
[^\"\\]*(?:\\.[^\"\\]*)* - any 0+ chars other than " and \ and then zero or more repetitions of a \ followed with any char but a line break char and then any 0+ chars other than \ and ".

This did it!! Thank you very much! – adymanav Oct 07 '20 at 13:57 — adymanav, Oct 07 '20 at 13:57

1 Answers1