Getting Data In
Highlighted

Anonymize data

New Member

Hi,

How would I anonymize the following example:

BankName=South!@Indian!@Bank

I want everything to the right of the equal sign to be removed/masked/covered

0 Karma
Highlighted

Re: Anonymize data

Ultra Champion

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata

Pseudo example based on the docs to get you started. Would need a better data sample of full log events to give you a more accurate regex.

props.conf

[my-spec]
TRANSFORMS-anonymize = my-anonymizer

transforms.conf

[my-anonymizer]
REGEX = (?m)^(.*)BankName=\w+!@\w+!@\w+(.*)$
FORMAT = $1BankName=########$2
DEST_KEY = _raw
0 Karma