Splunk Search

Using transforms and props to search and replace multiple fields in an event

brettcave
Builder

If I have an event that looks like this:

META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})

And I want to use a single transforms to replace the values for foo, color and size, to produce logs like:

META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})

I wanted to use the following in transforms, but it's only replacing the first field:

REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3

It only masks the first value, how would I match multiple values?

Sample log output

    META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

brettcave
Builder

thanks @richgalloway , am testing this now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Still testing? If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

GindiKhangura
Explorer

@brettcave,

Legend has it that @richgalloway is still looking for that upvote.

0 Karma

brettcave
Builder

accepted answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...