How to mask the verificaition code using props and transforms

[abhi04]

How can I mask the verfiication code using props/transforms?

{"body": " Verification Code: 123456",

I want to mask the code using props and transforms using below format, not sure how the search spl regex is different than regex in transforms

props.conf

[source::abc]
TRANSFORMS-anonymize = abc-anonymizer

transforms.conf
[abc-anonymizer]
DEST_KEY = _raw
REGEX = 
FORMAT = $1######$2

[abhi04]

Thanks @richgalloway  and @gcusello 

[gcusello]

Hi @abhi04 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @abhi04 ,

I usually use the solution with SEDCMD hinted by @richgalloway .

Anyway, also the solution with props amd transforms should run:

props.conf

[source::abc]
TRANSFORMS-anonymize = abc-anonymizer

transforms.conf
[abc-anonymizer]
DEST_KEY = _raw
REGEX = Verification Code:\d+ 
FORMAT = Verification Code:######

Ciao.

Giuseppe

[richgalloway · Accepted solution]

Why use both props AND transforms when you can do it with just props?

[source::abc]
SEDCMD-anonymizer = s/Verification Code: \d+"/Verification Code: ######/g