Getting Data In

How to create regex that indexes time masking maintaining string length vol. III

bruncio
Engager

Hi all,
as in the previous posts I and II I'd like to anonymize names of cities and to keep the length of a string.
The nature of logs is quite complex. I'm sharing the part in question:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=Berlin
F_BV_FREITEXTANTRAG= ---------------

What I'd like to get is:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=XXXXXX
F_BV_FREITEXTANTRAG= ---------------

Sometimes, unfortunately, the names are more complex and include processing errors:

F_BEHOERDE=Stadt Rastatt B\xFCrgerb\xFCro
then I'd like to get:
F_BEHOERDE=XXXXX XXXXXXX XXXXXXXXXXXXXXXX

I've managed to create the regex which anonymizes city names but doesn't keep the length of them. If the dynamic version is not possible. Probably I will need to stick with this:

s/F_BEHOERDE=.*/F_BEHOERDE=XXXXX/g

 I'll be grateful for any hints

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...