Getting Data In

Transforms not replacing original value

thard_splunk
Splunk Employee
Splunk Employee

Hello,

I have a CSV in which I am attempting to shorten a 128 character string down to the last 8 characters. I used the following configuration in transforms/props:

props.conf:

[taxi_csv]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
description = Comma-separated value format. Set header and other settings in "D$
TIMESTAMP_FIELDS = Trip Start Timestamp
TZ = America/Chicago
TRANSFORM-mask = taxiMask

transforms.conf:

[taxiMask]
REGEX = (\w{120})(\w{8})
FORMAT = "Taxi ID"::$2
WRITE_META = true
SOURCE_KEY = field:"Taxi ID"
DEST_KEY = _raw

However, the resulting indexed data contains both the original string and the shortened string as two separate values in the same field. What configuration change can I make to replace the original value with the shortened string?

Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this for your transforms.conf entry

[taxiMask]
REGEX = (?m)^(.*)(\w{120})(\w{8})(.*)$
FORMAT = $1$3$4
DEST_KEY = _raw
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...