Splunk Search

Splunk Light Email Anonymization before Indexing

mseidel
New Member

Hello everybody,

I am new to Splunk and I try to anonymize an email adress of my Logfile with the help of files props.conf and transforms.conf.
I copied the files into the etc/system/local directory and adopt them like this:

props.conf:
[MyLog]
TRANSFORMS-anonymize = email-anonymizer

transforms.conf:
[email-anonymizer]
DEST_KEY = raw
REGEX = ([a-zA-Z0-9
.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+)
FORMAT = *********

This is a row of my sample Logfile:

Oct 26 09:38:24 AAA123 BBB adhjjd adjhah massss@web.de dkjasd adkdsjkd

I stopped Splunk, cleaned the index and started Splunk new. The source name of my Logfile is "MyLog".
Thats what Splunk made out of it:

10/26/17 9:38:24.000 AM *********

I also tried FORMAT=$1*****$2, to concat the strings, but this does not work at all.
Can anybody please give me a hint, what I'm doing wrong or if it is better to use a sed cmd?

Thanks in advance
Mel

0 Karma

mseidel
New Member

Hello everybody,

I helped myself by creating a working sed script.

[MyLog]
SEDCMD-mel = s/([a-zA-Z0-9_.+-]+\@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)/**@**.**/g

I'm quite sure the other way does not work correctly or only for key/value pairs.

Greetings
Mel

0 Karma

Richfez
SplunkTrust
SplunkTrust

mseidel - I changed your snippet to "code" - Hopefully that made the formatting preserved better.

I think it entirely appropriate for you to accept your own answer in this case and collect your karma. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...