Archive

How to create a regex expression to mask the input?

Explorer

Hi,
Can someone help with regex expression to mask the below kind of pattern. I need this pattern of text to be masked wherever I find it in my events.

12/KQXA/123456/ABXY --> **************ABXY 
11/VAXA/123456    /VAQY --> **************VAQY 
00/LCXA/545232/GYFT --> **************GYFT 
0 Karma

Influencer

Try this query:

| makeresults | eval _raw="12/KQXA/123456/ABXY --> SPLUNKAAAAAAAAABXY" | append [| makeresults | eval _raw="11/VAXA/123456/VAQY      --> AAXZAAAAAAAAAAVAQY" ] | append [| makeresults | eval _raw="00/LCXA/545232/GYFT --> A1AAAAAX50AAAAAGYFT"] | rex field=_raw mode=sed "s/\w{14}/***************/g"