Getting Data In

How to create regex that indexes time masking maintaining string length vol. III

bruncio
Engager

Hi all,
as in the previous posts I and II I'd like to anonymize names of cities and to keep the length of a string.
The nature of logs is quite complex. I'm sharing the part in question:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=Berlin
F_BV_FREITEXTANTRAG= ---------------

What I'd like to get is:

2022-03-31 15:23:11,210 INFO ...
 - ... 381 lines omitted ...
F_AUSWEISENDE=12.02.2022 
F_AUSWEISNUMMER=A2A2A2AAA
F_BEHOERDE=XXXXXX
F_BV_FREITEXTANTRAG= ---------------

Sometimes, unfortunately, the names are more complex and include processing errors:

F_BEHOERDE=Stadt Rastatt B\xFCrgerb\xFCro
then I'd like to get:
F_BEHOERDE=XXXXX XXXXXXX XXXXXXXXXXXXXXXX

I've managed to create the regex which anonymizes city names but doesn't keep the length of them. If the dynamic version is not possible. Probably I will need to stick with this:

s/F_BEHOERDE=.*/F_BEHOERDE=XXXXX/g

 I'll be grateful for any hints

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...