https://community.splunk.com/t5/Splunk-Search/Unable-to-mask-data-using-Regex/m-p/438690#M124852 <P>First of all you are using $1 and $2 in FORMAT. Every $n represents exactly one capture group in your REGEX. So in your FORMAT you use one capture group more than in your REGEX. That can't work obviously. You don't want to capture what you want to change. You want to capture what you want to keep. So what you probably want to do is using something like this.</P> <P>REGEX = (.*splunk\[)\d+(\].*)<BR /> FORMAT = $1####$2</P> <P>I tested it and it worked.</P> Mon, 12 Aug 2019 13:59:31 GMT dpeukert 2019-08-12T13:59:31Z https://community.splunk.com/t5/Splunk-Search/Unable-to-mask-data-using-Regex/m-p/438689#M124851 <P>I'm testing the data-mask feature by anonymizing the numbers in the brackets: splunk[<STRONG>9085</STRONG>] but it's not working<BR /> Is my regex expression incorrect? (generated using an online tool - <A href="https://regex101.com/">https://regex101.com/</A>)<BR /> Guide: <A href="https://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles">https://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles</A></P> <P>Sample Log:<BR /> <CODE>Aug 12 09:22:00 forwarder splunk[9085]: #011Checking default conf files for edits...</CODE></P> <P><STRONG>Forwarder configurations:</STRONG></P> <P>props.conf:<BR /> <CODE>[linux_logs]</CODE><BR /> <CODE>TRANSFORMS-anonymize = dhclient-anonymizer</CODE></P> <P>transforms.conf:<BR /> <CODE>[dhclient-anonymizer]</CODE><BR /> <CODE>REGEX = splunk\[(\d+)\]</CODE><BR /> <CODE>FORMAT = $1splunk[####]$2</CODE><BR /> <CODE>DEST_KEY = _raw</CODE></P> Mon, 12 Aug 2019 09:43:13 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-mask-data-using-Regex/m-p/438689#M124851 bdalsania_splun 2019-08-12T09:43:13Z https://community.splunk.com/t5/Splunk-Search/Unable-to-mask-data-using-Regex/m-p/438690#M124852 <P>First of all you are using $1 and $2 in FORMAT. Every $n represents exactly one capture group in your REGEX. So in your FORMAT you use one capture group more than in your REGEX. That can't work obviously. You don't want to capture what you want to change. You want to capture what you want to keep. So what you probably want to do is using something like this.</P> <P>REGEX = (.*splunk\[)\d+(\].*)<BR /> FORMAT = $1####$2</P> <P>I tested it and it worked.</P> Mon, 12 Aug 2019 13:59:31 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-mask-data-using-Regex/m-p/438690#M124852 dpeukert 2019-08-12T13:59:31Z