Is there a way to use sedcmd in props.conf to mask firstName, lastName, and birthDate values in my data?

[locose]

I'm trying to mask birthDate and firstname. For example my Splunk results yields something like....

<firstName>james</firstName>
<lastName>bond</lastName>
<birthDate>01/10/1960</birthDate>

Is there a way to use sedcmd in the props.conf file mask everything between, for example:

<firstName>xxxxxx</firstName> 
<lastName>xxxxxxx</lastName>
<birthDate>xxxxxx</birthDate>

Thanks

[woodcock · Accepted solution]

Yes, try this:

SEDCMD-firstName= s/(<firstName>).*(<\/firstName>)/\1xxxxxx\2/
SEDCMD-lastName= s/(<lastName>).*(<\/lastName>)/\1xxxxxxx\2/
SEDCMD-birthDate= s/(<birthDate>).*(<\/birthDate>)/\1xxxxxx\2/

[locose]

Thank you.

[sundareshr]

Here's some good documentation on how to anonymize data. You can apply this concept to your data to mask first, last and birthdate

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles