Getting Data In

Data Masking

muguniya
Explorer

Hi Team,

I need to mask multiple phrase in XML file. where in the complete XML file is in one single line. Please confirm will below setup will do the job

transforms.conf

[memberid-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberID>XXXXX$2
REGEX = (?m)^(.*)memberID>\w+(\w{4}[\<"].*)$
SOURCE_KEY = _raw

[firstname-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberFirstName>XXXXXXXXX$2
REGEX = (?m)^(.*)memberFirstName>\w+(\w{0}[\<"].*)$
SOURCE_KEY = _raw

[lastname-anonymizer]
DEST_KEY = _raw
FORMAT = $1memberLastName>XXXXXXXXX$2
REGEX = (?m)^(.*)memberLastName>\w+(\w{0}[\<"].*)$
SOURCE_KEY = _raw

props.conf

[testsandbox]
TRANSFORMS-anonymize = memberid-anonymizer, firstname-anonymizer, lastname-anonymizer

Sample Event:

2014-04-11 53:14:37,751 INFO  [WebContainer : 24] (UrgentCareController.java:) - InterPortletObjects from pp <com.sample.test.MytestObjects>
  <memberID>1234567</memberID>
  <memberlifeID>1294032</memberlifeID>
  <memberFirstName>Mugunthan</memberFirstName>
  <memberLastName>Gopala</memberLastName>
</com.sample.test.MytestObjects>  

Thanks
Mugunthan

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That should work, though I recommend using props.conf SEDCMD-class instead - something like this:

[testsandbox]
SEDCMD-memberid = s/(<memberID>)\w+(\w{4}</memberID>)/\1XXXXX\2/g
SEDCMD-membername = s/(<member(?:First|Last)Name>)[^<]+(</member(?:First|Last)Name>)/\1XXXXXXXX\2/g

I personally prefer this for simplicity when all you need is a simple anonymizing replace.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...