Getting Data In

Anonymize data using regex transform

vaibhavagg2006
Communicator

Hi Splunk experts,
I am using regex transform to mask data in splunk. But splunk only masks first occurence of string matched with that regex in 1 event.For example

[user]
REGEX = (?i)^(.*?)user\=\w+(.*)$
FORMAT = $1user=XXXXXXX$2
DEST_KEY = _raw

Sample event

2013-02-22 user=xyz hello user=abc

It will just mask user=xyz and will not touch user=abc.

Do we have any solution for this.

Thanks

Tags (3)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

Ayn
Legend

...but SEDCMD is using regex. I really don't see the problem.

0 Karma

vaibhavagg2006
Communicator

May b because I have already followed that route and implemented data masking and now i have to do all the work again using SED CMD 😞 .So looking for solution using regex only

0 Karma

Ayn
Legend

It might be but why would you go for that route when SEDCMD exists?

0 Karma

vaibhavagg2006
Communicator

So you mean it is not possible using regex transform?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...