Correct syntax for syslog source in props.conf for SEDCMD

[jbertoli]

I would like to ensure that ssn's are anonymized, can anyone tell me what the source type should be for syslog? In the splunk browser the source shows up as udp:514, how should this be added to the source reference in the props.conf file. Cheers jb

[source::.../upd:514]
SEDCMD-accounts = s/ssn=\"\d{3}\-\d{2}\-\d{4}\"/=>\"xxx-xx-xxxx\"/g 

[ftk]

If you want to work off of the source field and the source is indeed udp:514, put this in your props.conf:

[source::udp:514]
SEDCMD-accounts = s/ssn=\"\d{3}-\d{2}-\d{4}\"/=>\"xxx-xx-xxxx\"/g

Or you could work off of whatever sourcetype is assigned to the data. If the sourcetype syslog is assigned, configure props.conf as follows:

[syslog]
SEDCMD-accounts = s/ssn=\"\d{3}-\d{2}-\d{4}\"/=>\"xxx-xx-xxxx\"/g