I need to mask WILLIAM
as seen below:
2015-03-18 10:04:37,453 [WebContainer : 1] INFO com.farmers.ffq.saq.service.SAQService - Req for 97995437 Quote: <com.farmers.ffq.saq.webservice.PrefillProspectDataForAutoQuote>
<requestHeader>
<userId>FFQ138</userId>
<functionName>0</functionName>
</requestHeader>
<isBILimitSelected>false</isBILimitSelected>
<isCurrentCarrierSelected>false</isCurrentCarrierSelected>
<isPDLimitSelected>false</isPDLimitSelected>
<numberOfCacheDays>-1</numberOfCacheDays>
<prospectCustomer>
<firstName>WILLIAM</firstName>
I have been trying to use this regex in my transforms.conf:
[FirstName-anonymizer]
REGEX = (?ms)^(.\*)\<[fF]irstName>\d{1,10}.\*)$
FORMAT = $1##########$2
DEST_KEY = _raw
however, the output from the above eliminates all other data for the record so in Splunk, all you will see for each event is:
$1<firstName>########<firstName>$2
The above was based on the example from:
http://answers.splunk.com/answers/73298/masking-ssn-info-into-splunk-at-index-time.html
I have also looked at:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Anonymizedatausingconfigurationfiles
Can anyone help?
Hi mookiie,
Have you tried your regex pattern at an online regex tester before you applied it to your Splunk configuration? I've tried using your regex pattern with your sample data and I found an error for your pattern [you have ')' before '$', but no '(' to make a complete bracket].
I tried to make a new pattern for your sample data:
(?ms)^(.*\<[fF]irstName\>)\w+(.*)$
Hope it helps.
Hi mookiie,
Have you tried your regex pattern at an online regex tester before you applied it to your Splunk configuration? I've tried using your regex pattern with your sample data and I found an error for your pattern [you have ')' before '$', but no '(' to make a complete bracket].
I tried to make a new pattern for your sample data:
(?ms)^(.*\<[fF]irstName\>)\w+(.*)$
Hope it helps.
Thank you so much! This is the first time we have tried to mask data and it was driving me nutz! Again thank you for taking the time to help out a fellow splunker!
No problem. Glad to be of any help 🙂