How to redact the description field from the Service WinHostMon?

[JChris_]

I'm trying to redact the description field from the Service WinHostMon to have something like that:

Before:

Type=Service
Name="LoremIpsum"
DisplayName="Lipsum service"
Description="Bla bla bla bla bla."
Path="C:\path\to\software.exe"
ServiceType="Unknown"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=123

After:

Type=Service
Name="LoremIpsum"
DisplayName="Lipsum service"
Description="redacted"
Path="C:\path\to\software.exe"
ServiceType="Unknown"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=123

I have a Windows host running Splunk UF, which then sends the data to a Splunk HF, which then sends it to Splunk Cloud. In the Splunk HF I already tried 2 approaches, both failed:

Approach 1:

Splunk HF > system/local/props.conf

[source::service]
SEDCMD-redact=s/\/Description=.+\n/\/Description="redacted"\n/g

Approach 2:

Splunk HF > system/local/props.conf

[source::service]
TRANSFORMS-my_transf = remove-desc

Splunk HF > system/local/transforms.conf

[remove-desc]
REGEX = (?mi)((?:.|\n)+Description=).+(\n(?:.|\n)+)
FORMAT = $1"redacted"$2
DEST_KEY = _raw

So, how can I redact the description field?

[richgalloway · Accepted solution]

SEDCMD will work with the right regex.  Linefeeds are removed by the default line breaker so a regex is unlikely to find them.  Try this, instead.

[source::service]
SEDCMD-redact=s/Description=".+"/Description="redacted"/