Anonymize data is not working,

[ahmadjabr]

hello,

I made my Anonymize data based on this http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata
and I checked it million times.
I have distributed installation and I have done this on "indexer"

[xyz:abc:auto]
TRANSFORMS-anonymize = password-anonymizer

[password-anonymizer]
REGEX = (?m)^(.)Password=\w+%(\w{0}[^&].)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

[Yunagi]

Try the following changes:

[password-anonymizer]
REGEX = (?m)^(.*)Password=[^%]*(.*)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Please note that this configuration belongs into transforms.conf. The other two lines you posted belong into props.conf.

You will need to restart your indexers after making such changes.

Also make sure that your data has the correct sourcetype assigned. (In your case, that would be "xyz:abc:auto".)

On a more general note, I often use this website for testing purposes when dealing with regex:
https://regex101.com/

[ahmadjabr]

I found out that the indexer doesn't even do anything with the log, it's like it doesn't read the stanza I made.
and I moved it to the top but its the same nothing happened

[Yunagi]

Run the following commands on your indexer to check that Splunk finds your configuration:
/opt/splunk/bin/splunk btool props list
/opt/splunk/bin/splunk btool transforms list
Is your configuration listed here?

Which sourcetype does your data have? If the props.conf stanza is [xyz:abc:auto] as you posted then the sourcetype of your data must be "xyz:abc:auto".

[gcusello]

Hi ahmadjabr,
can you share an example of log to anonymize, your regex isnot so clear?
Bye.
giuseppe

[ahmadjabr]

2017-12-18 07:42:19 10.0.1.1 GET /send.asmx/Send Username=CENTER&Password=asdqweasd%23&Sender=xyyzetc etcetcetectecetetctec

[gcusello]

Hi ahmadjabr,
try a different regex escaping = and %

REGEX = (?m)^.*Password\=\w+\%.*$

Bye.
Giuseppe

[Yunagi]

The link you provided says: "The forwarded data must arrive at the indexer already parsed." Do you perhaps have a heavy forwarder in place?

If you have a heavy forwarder in place, move your anonymization configuration from the indexers to the heavy forwarders.

[ahmadjabr]

I don't have heavy forwarder I have universal forwarder, will it work?
and universal forwarder on the windows machine

[Yunagi]

Universal forwarders do not parse the data. So keep this configuration on the indexers.