Hello we are trying to mask an account#'s last 5 digits. I have added this to props.conf
[annon]
TRANSFORMS-anonymize = hideacct-number
and this to transforms.conf
[hideacct-number]
REGEX=(.*AcctCode=\d{5}-).*
FORMAT=$1xxxxx
I stopped splunk and cleaned the index and then started it again and the account numbers are still there completely. What are we missing?
Update: I am using 4.2.3 and I am trying to mask the last 5 characters with X's. I am trying JSapienza's answer now and will keep you posted. Thanks!
Update2: That did not help. It does not change my data. I tried REPORT as well with the same results.
Turns out it was a combination of JSapienza's answer and removing my header in props.conf:
props.conf:
EXTRACT-
TRANSFORMS = hideacct-number
transforms.conf:
[hideacct-number]
DEST_KEY =_raw
REGEX=(.AcctCode=\d{5}-).
FORMAT=$1xxxxx
and apparently the DEST_KEY =_raw needs to be at the top of transforms.conf
Another way, albeit external and not free, is with a third-party masking tool for the data sources you would index into Splunk. I found this:
Another, perhaps simpler, way of accomplishing this is by using SEDCMD
. See http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatawithsed
Turns out it was a combination of JSapienza's answer and removing my header in props.conf:
props.conf:
EXTRACT-
TRANSFORMS = hideacct-number
transforms.conf:
[hideacct-number]
DEST_KEY =_raw
REGEX=(.AcctCode=\d{5}-).
FORMAT=$1xxxxx
and apparently the DEST_KEY =_raw needs to be at the top of transforms.conf
Karl,
Can you provide some additional information? It is always helpful to understand what version you are running.
Also can explain in a little more detail what you are trying to do? Are you attempting to take an account number that is in the format ##### to replace the "numbers" with "xxxxx"?
If I'm not mistaken, I think you need to set the DEST_KEY = _raw so the indexer knows to mask at index time from the raw event.
This did not help. I added this to transforms.conf and it still does not modify the data in the field at all.