Splunk Search

Unable to mask data using Regex

bdalsania_splun
Splunk Employee
Splunk Employee

I'm testing the data-mask feature by anonymizing the numbers in the brackets: splunk[9085] but it's not working
Is my regex expression incorrect? (generated using an online tool - https://regex101.com/)
Guide: https://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles

Sample Log:
Aug 12 09:22:00 forwarder splunk[9085]: #011Checking default conf files for edits...

Forwarder configurations:

props.conf:
[linux_logs]
TRANSFORMS-anonymize = dhclient-anonymizer

transforms.conf:
[dhclient-anonymizer]
REGEX = splunk\[(\d+)\]
FORMAT = $1splunk[####]$2
DEST_KEY = _raw

Tags (2)
0 Karma
1 Solution

dpeukert
Explorer

First of all you are using $1 and $2 in FORMAT. Every $n represents exactly one capture group in your REGEX. So in your FORMAT you use one capture group more than in your REGEX. That can't work obviously. You don't want to capture what you want to change. You want to capture what you want to keep. So what you probably want to do is using something like this.

REGEX = (.*splunk\[)\d+(\].*)
FORMAT = $1####$2

I tested it and it worked.

View solution in original post

0 Karma

dpeukert
Explorer

First of all you are using $1 and $2 in FORMAT. Every $n represents exactly one capture group in your REGEX. So in your FORMAT you use one capture group more than in your REGEX. That can't work obviously. You don't want to capture what you want to change. You want to capture what you want to keep. So what you probably want to do is using something like this.

REGEX = (.*splunk\[)\d+(\].*)
FORMAT = $1####$2

I tested it and it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...