Getting Data In

Anonymize data using regex transform

vaibhavagg2006
Communicator

Hi Splunk experts,
I am using regex transform to mask data in splunk. But splunk only masks first occurence of string matched with that regex in 1 event.For example

[user]
REGEX = (?i)^(.*?)user\=\w+(.*)$
FORMAT = $1user=XXXXXXX$2
DEST_KEY = _raw

Sample event

2013-02-22 user=xyz hello user=abc

It will just mask user=xyz and will not touch user=abc.

Do we have any solution for this.

Thanks

Tags (3)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

Ayn
Legend

...but SEDCMD is using regex. I really don't see the problem.

0 Karma

vaibhavagg2006
Communicator

May b because I have already followed that route and implemented data masking and now i have to do all the work again using SED CMD 😞 .So looking for solution using regex only

0 Karma

Ayn
Legend

It might be but why would you go for that route when SEDCMD exists?

0 Karma

vaibhavagg2006
Communicator

So you mean it is not possible using regex transform?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...