<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Data Masking in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Data-Masking/m-p/129338#M97756</link>
    <description>&lt;P&gt;That should work, though I recommend using props.conf &lt;CODE&gt;SEDCMD-class&lt;/CODE&gt; instead - something like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[testsandbox]
SEDCMD-memberid = s/(&amp;lt;memberID&amp;gt;)\w+(\w{4}&amp;lt;/memberID&amp;gt;)/\1XXXXX\2/g
SEDCMD-membername = s/(&amp;lt;member(?:First|Last)Name&amp;gt;)[^&amp;lt;]+(&amp;lt;/member(?:First|Last)Name&amp;gt;)/\1XXXXXXXX\2/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I personally prefer this for simplicity when all you need is a simple anonymizing replace.&lt;/P&gt;</description>
    <pubDate>Sat, 12 Apr 2014 05:58:09 GMT</pubDate>
    <dc:creator>martin_mueller</dc:creator>
    <dc:date>2014-04-12T05:58:09Z</dc:date>
    <item>
      <title>Data Masking</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Data-Masking/m-p/129337#M97755</link>
      <description>&lt;P&gt;Hi Team,&lt;/P&gt;

&lt;P&gt;I need to mask multiple phrase in XML file. where in the complete XML file is in one single line. Please confirm will below setup will do the job &lt;/P&gt;

&lt;P&gt;transforms.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[memberid-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberID&amp;gt;XXXXX$2
REGEX = (?m)^(.*)memberID&amp;gt;\w+(\w{4}[\&amp;lt;"].*)$
SOURCE_KEY = _raw

[firstname-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberFirstName&amp;gt;XXXXXXXXX$2
REGEX = (?m)^(.*)memberFirstName&amp;gt;\w+(\w{0}[\&amp;lt;"].*)$
SOURCE_KEY = _raw

[lastname-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberLastName&amp;gt;XXXXXXXXX$2
REGEX = (?m)^(.*)memberLastName&amp;gt;\w+(\w{0}[\&amp;lt;"].*)$
SOURCE_KEY = _raw
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[testsandbox]
TRANSFORMS-anonymize = memberid-anonymizer, firstname-anonymizer, lastname-anonymizer
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Sample Event:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;2014-04-11 53:14:37,751 INFO  [WebContainer : 24] (UrgentCareController.java:) - InterPortletObjects from pp &amp;lt;com.sample.test.MytestObjects&amp;gt;
  &amp;lt;memberID&amp;gt;1234567&amp;lt;/memberID&amp;gt;
  &amp;lt;memberlifeID&amp;gt;1294032&amp;lt;/memberlifeID&amp;gt;
  &amp;lt;memberFirstName&amp;gt;Mugunthan&amp;lt;/memberFirstName&amp;gt;
  &amp;lt;memberLastName&amp;gt;Gopala&amp;lt;/memberLastName&amp;gt;
&amp;lt;/com.sample.test.MytestObjects&amp;gt;  
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;BR /&gt;
Mugunthan&lt;/P&gt;</description>
      <pubDate>Fri, 11 Apr 2014 19:56:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Data-Masking/m-p/129337#M97755</guid>
      <dc:creator>muguniya</dc:creator>
      <dc:date>2014-04-11T19:56:13Z</dc:date>
    </item>
    <item>
      <title>Re: Data Masking</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Data-Masking/m-p/129338#M97756</link>
      <description>&lt;P&gt;That should work, though I recommend using props.conf &lt;CODE&gt;SEDCMD-class&lt;/CODE&gt; instead - something like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[testsandbox]
SEDCMD-memberid = s/(&amp;lt;memberID&amp;gt;)\w+(\w{4}&amp;lt;/memberID&amp;gt;)/\1XXXXX\2/g
SEDCMD-membername = s/(&amp;lt;member(?:First|Last)Name&amp;gt;)[^&amp;lt;]+(&amp;lt;/member(?:First|Last)Name&amp;gt;)/\1XXXXXXXX\2/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I personally prefer this for simplicity when all you need is a simple anonymizing replace.&lt;/P&gt;</description>
      <pubDate>Sat, 12 Apr 2014 05:58:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Data-Masking/m-p/129338#M97756</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-04-12T05:58:09Z</dc:date>
    </item>
  </channel>
</rss>

