Getting Data In

How to create regex that indexes time masking maintaining string length vol. III

bruncio
Engager

Hi all,
as in the previous posts I and II I'd like to anonymize names of cities and to keep the length of a string.
The nature of logs is quite complex. I'm sharing the part in question:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=Berlin
F_BV_FREITEXTANTRAG= ---------------

What I'd like to get is:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=XXXXXX
F_BV_FREITEXTANTRAG= ---------------

Sometimes, unfortunately, the names are more complex and include processing errors:

F_BEHOERDE=Stadt Rastatt B\xFCrgerb\xFCro
then I'd like to get:
F_BEHOERDE=XXXXX XXXXXXX XXXXXXXXXXXXXXXX

I've managed to create the regex which anonymizes city names but doesn't keep the length of them. If the dynamic version is not possible. Probably I will need to stick with this:

s/F_BEHOERDE=.*/F_BEHOERDE=XXXXX/g

 I'll be grateful for any hints

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...