topic Re: How to mask the verificaition code using props and transforms in Getting Data In

How to mask the verificaition code using props and transforms

abhi04 — Mon, 11 Dec 2023 23:56:46 GMT

How can I mask the verfiication code using props/transforms?

{"body": " Verification Code: 123456",

I want to mask the code using props and transforms using below format, not sure how the search spl regex is different than regex in transforms

props.conf

[source::abc]
TRANSFORMS-anonymize = abc-anonymizer

transforms.conf
[abc-anonymizer]
DEST_KEY = _raw
REGEX =
FORMAT = $1######$2

Re: How to mask the verificaition code using props and transforms

richgalloway — Tue, 12 Dec 2023 01:12:03 GMT

Why use both props AND transforms when you can do it with just props?

[source::abc] SEDCMD-anonymizer = s/Verification Code: \d+"/Verification Code: ######/g

Re: How to mask the verificaition code using props and transforms

gcusello — Tue, 12 Dec 2023 07:22:05 GMT

Hi @abhi04 ,

I usually use the solution with SEDCMD hinted by @richgalloway .

Anyway, also the solution with props amd transforms should run:

props.conf [source::abc] TRANSFORMS-anonymize = abc-anonymizer transforms.conf [abc-anonymizer] DEST_KEY = _raw REGEX = Verification Code:\d+ FORMAT = Verification Code:######

Ciao.

Giuseppe

Re: How to mask the verificaition code using props and transforms

abhi04 — Tue, 12 Dec 2023 15:17:56 GMT

Thanks @richgalloway and @gcusello

Re: How to mask the verificaition code using props and transforms

gcusello — Tue, 12 Dec 2023 15:35:20 GMT

Hi @abhi04 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉