Getting Data In

Anonymize data using regex transform

vaibhavagg2006
Communicator

Hi Splunk experts,
I am using regex transform to mask data in splunk. But splunk only masks first occurence of string matched with that regex in 1 event.For example

[user]
REGEX = (?i)^(.*?)user\=\w+(.*)$
FORMAT = $1user=XXXXXXX$2
DEST_KEY = _raw

Sample event

2013-02-22 user=xyz hello user=abc

It will just mask user=xyz and will not touch user=abc.

Do we have any solution for this.

Thanks

Tags (3)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

Ayn
Legend

...but SEDCMD is using regex. I really don't see the problem.

0 Karma

vaibhavagg2006
Communicator

May b because I have already followed that route and implemented data masking and now i have to do all the work again using SED CMD 😞 .So looking for solution using regex only

0 Karma

Ayn
Legend

It might be but why would you go for that route when SEDCMD exists?

0 Karma

vaibhavagg2006
Communicator

So you mean it is not possible using regex transform?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...