KB 177 - Metric field filter

KB 177(ABAP): Metric field filter

Description

PowerConnect framework has a possibility to control field content (clear , hash or obfuscate data) which is sent to Splunk. The functionality is available in Administrator->Setup Metric->Field filter menu option:

Before SP 7.02:

Here ‘Hash’ checkbox could be used to hash the field data. ‘Active’ checkbox could be used to clear/remove field content.

‘Rule set ID’ column could be used to define regex expression to replace the field content or used to obfuscate the data. This functionality is explained below.

SP 702+:

Here it is possible to define various options for the data:

• Default - keep field content as is;

• Clear value - clear field content from the event (the event will be still sent to Splunk);

• Hash value - replace the value with a hash;

• Remove field - remove field from the event (field will not be sent to Splunk);

• Remove if empty - remove field from the event if the field contains no data;

• Filter value (regexp rule) - use Rule set ID (represent set of regular expressions) defined in column ‘Rule set ID'. It could be used to replace the field content or obfuscate the data;

Obfuscate rules are available in Administrator->Setup Metric->Obfuscate Rules menu option:

In order to create Obfuscate rule set, please follow the steps below:

1. Define RuleSet (left side one the screen)

   

2. Create Rules (right side of the screen)

   

3. Drag and drop Rule from right side of the screen to RuleSet on the left side

   

4. Activate the RuleSet as shown on the top screen.

5. Save the configuration

Once created, Obfuscate RuleSet could be assigned to specific fields in Administrator->Setup Metric->Field Filter:

Product version