topic i just want to extract the number from the below sentance and replace with xxxx . Help me in Splunk Search

i just want to extract the number from the below sentance and replace with xxxx . Help me

DataOrg — Wed, 13 Dec 2017 03:20:53 GMT

the Information in service : ID R1-7857hi75 is duplicated

i want to make it as
the Information in service : ID R1-******* is duplicated

Re: i just want to extract the number from the below sentance and replace with xxxx . Help me

harsmarvania57 — Wed, 13 Dec 2017 03:32:56 GMT

Hi @premranjithj,

If you want to anonymise during search time you use below query

< your search> | rex mode=sed "s/(?m)(\-)(\w+)/\1xxx/g

If you want to anonymise value during index time, please add below config on props.conf in Indexer or Heavy Forwarder whichever comes first.

props.conf

[yoursourcetype]
SEDCMD-maskvalue = s/(?m)(\-)(\w+)/\1xxx/g

I hope this helps.

Thanks,
Harshil

Re: i just want to extract the number from the below sentance and replace with xxxx . Help me

DataOrg — Wed, 13 Dec 2017 04:16:09 GMT

@harsmarvania57. thanks its worked.
can you please explain me the expression. i just want to understand to form other expression

Re: i just want to extract the number from the below sentance and replace with xxxx . Help me

harsmarvania57 — Wed, 13 Dec 2017 04:33:14 GMT

I am using sed mode in rex so in expression format is s/regexp/replacement/flags, in this format s means substitute then regex (?m)(\-)(\w+) (This will find data in (?m)->multiline with pattern - (-) in first capturing group (\w+) means word with any length in second capturing group) and replacement is \1xxx (Which will replace 2nd capturing group with xxx) and flag is g (Apply the replacement to all matches to the regexp, not just the first.)

For more explanation and play with regex with your sample data please refer https://regex101.com/r/HHefSs/1

Please accept my answer and upvote it, as it worked for you.

Re: i just want to extract the number from the below sentance and replace with xxxx . Help me

DataOrg — Wed, 13 Dec 2017 04:40:26 GMT

@harsnarvania57. thanks much for making me to understand. its really good