Anonymize data using regex transform

[vaibhavagg2006]

Hi Splunk experts,
I am using regex transform to mask data in splunk. But splunk only masks first occurence of string matched with that regex in 1 event.For example

[user]
REGEX = (?i)^(.*?)user\=\w+(.*)$
FORMAT = $1user=XXXXXXX$2
DEST_KEY = _raw

Sample event

2013-02-22 user=xyz hello user=abc

It will just mask user=xyz and will not touch user=abc.

Do we have any solution for this.

Thanks

[okrabbe_splunk · Accepted solution]

I would personally look at using a sed command instead:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles#Through...

The following is not tested but it should give you an idea.

SEDCMD-user = s/user=(\w+)/user=xxxxx/g

[Ayn]

...but SEDCMD is using regex. I really don't see the problem.

[vaibhavagg2006]

May b because I have already followed that route and implemented data masking and now i have to do all the work again using SED CMD 😞 .So looking for solution using regex only

[Ayn]

It might be but why would you go for that route when SEDCMD exists?

[vaibhavagg2006]

So you mean it is not possible using regex transform?