https://community.splunk.com/t5/Getting-Data-In/Anonymize-data/m-p/331925#M61485 <P>Hi, </P> <P>How would I anonymize the following example:</P> <P>BankName=South!@Indian!@Bank</P> <P>I want everything to the right of the equal sign to be removed/masked/covered</P> Tue, 24 Oct 2017 18:07:19 GMT jdomin30 2017-10-24T18:07:19Z https://community.splunk.com/t5/Getting-Data-In/Anonymize-data/m-p/331925#M61485 <P>Hi, </P> <P>How would I anonymize the following example:</P> <P>BankName=South!@Indian!@Bank</P> <P>I want everything to the right of the equal sign to be removed/masked/covered</P> Tue, 24 Oct 2017 18:07:19 GMT https://community.splunk.com/t5/Getting-Data-In/Anonymize-data/m-p/331925#M61485 jdomin30 2017-10-24T18:07:19Z https://community.splunk.com/t5/Getting-Data-In/Anonymize-data/m-p/331926#M61486 <P><A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata">http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata</A></P> <P>Pseudo example based on the docs to get you started. Would need a better data sample of full log events to give you a more accurate regex.</P> <P><STRONG>props.conf</STRONG></P> <PRE><CODE>[my-spec] TRANSFORMS-anonymize = my-anonymizer </CODE></PRE> <P><STRONG>transforms.conf</STRONG></P> <PRE><CODE>[my-anonymizer] REGEX = (?m)^(.*)BankName=\w+!@\w+!@\w+(.*)$ FORMAT = $1BankName=########$2 DEST_KEY = _raw </CODE></PRE> Tue, 24 Oct 2017 19:22:26 GMT https://community.splunk.com/t5/Getting-Data-In/Anonymize-data/m-p/331926#M61486 Damien_Dallimor 2017-10-24T19:22:26Z