topic Re: Index time masking maintaining string length (continue) in Getting Data In

Index time masking maintaining string length (continue)

payl_chdhry — Wed, 19 Aug 2020 10:08:18 GMT

Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/514705

I have same requirement but for different format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet.

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240

should give me:

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240

Re: Index time masking maintaining string length (continue)

to4kawa — Wed, 19 Aug 2020 11:16:39 GMT

s/(\"\d+)(\d{4})/\1####/

Re: Index time masking maintaining string length (continue)

thambisetty — Wed, 19 Aug 2020 11:29:55 GMT

you have shared only one sample event. I have added few more digits to change length and see my regex is working or not. and also it mask only 4 digits always.

[yoursourcetype] SEDCMD=s/(\"\d{3,})(\d{4})/\1****/g