Getting Data In

Index time masking maintaining string length (continue)

payl_chdhry
Explorer

Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/51...

I have same requirement but for different  format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet.

 

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456                 " 1 240

should give me:

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX                 " 1 240

0 Karma

thambisetty
Super Champion

you have shared only one sample event. I have added few more digits to change length and see my regex is working or not. and also it mask only 4 digits always.

[yoursourcetype]
SEDCMD=s/(\"\d{3,})(\d{4})/\1****/g

regex-test.png

 

 

————————————
If this helps, give a like below.
0 Karma

to4kawa
SplunkTrust
SplunkTrust

s/(\"\d+)(\d{4})/\1####/

0 Karma