topic Re: Anonymize data using regex transform in Getting Data In

Anonymize data using regex transform

vaibhavagg2006 — Fri, 22 Feb 2013 06:50:42 GMT

Hi Splunk experts,
I am using regex transform to mask data in splunk. But splunk only masks first occurence of string matched with that regex in 1 event.For example

[user]
REGEX = (?i)^(.*?)user\=\w+(.*)$
FORMAT = $1user=XXXXXXX$2
DEST_KEY = _raw

Sample event

2013-02-22 user=xyz hello user=abc

It will just mask user=xyz and will not touch user=abc.

Do we have any solution for this.

Thanks

Re: Anonymize data using regex transform

okrabbe_splunk — Fri, 22 Feb 2013 08:52:55 GMT

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

Re: Anonymize data using regex transform

vaibhavagg2006 — Fri, 22 Feb 2013 09:57:21 GMT

So you mean it is not possible using regex transform?

Re: Anonymize data using regex transform

Ayn — Fri, 22 Feb 2013 10:05:54 GMT

It might be but why would you go for that route when SEDCMD exists?

Re: Anonymize data using regex transform

vaibhavagg2006 — Fri, 22 Feb 2013 10:47:36 GMT

May b because I have already followed that route and implemented data masking and now i have to do all the work again using SED CMD 😞 .So looking for solution using regex only

Re: Anonymize data using regex transform

Ayn — Fri, 22 Feb 2013 11:01:30 GMT

...but SEDCMD is using regex. I really don't see the problem.