How to resolve error "string index out of range" when anonymizing a diag?

[arowsell_splunk]

When anonymizing a diag as per the following:

https://docs.splunk.com/Documentation/Splunk/6.5.0/Troubleshooting/AnonymizedatasamplestosendtoSuppo...

An error is encountered on certain log files:

Error reading file /Users/arowsell/Documents/xxtest/ananon_diag_test//test_fail_1_event_bad.log and getting terms: string index out of range

Steps to reproduce:

1) Run following command on attached file test_fail_1_event_bad.log:

find pathtomyuncompresseddiag/ -name *.log* | xargs -I{} ./splunk anonymize file -source '{}'

2) Run the same command on the file test_fail_1_event_good.log and the error does not occur.

The only difference between the files seem to be the trailing white spaces at the end of the event.

[arowsell_splunk · Accepted solution]

The following bug was raised for this matter:

SPL-131827 : Error when anonymizing diag "string index out of range"

The error can be resolved by making the following changes

• Open the file $SPLUNK_HOME/bin/scrubber.py
• Look for MAX_SEGMENT = 1024 - change it to MAX_SEGMENT = 4096

Then re-run the anonymizing command