Masking sensitive information from event

[payal4296]

 Hi,I am trying to remove some of the sensitive information to be indexed by Splunk.

But these configurations are not working ,even after getting the configuration reflected over btool and validating the regex over SPL.

Anyone can assist?

props.conf
[o365:management:activity]
TRANSFORMS-anonymize = info-anonymizer
KV_MODE = json
TRUNCATE = 10485760

transforms.conf
[info-anonymizer]
DEST_KEY = _raw
FORMAT = $1$2
REGEX = (.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(\"ResultsTruncated\"\:.*)

Have already Validated regex over SPL, It is working fine.

|regex _raw="(.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(\"ResultsTruncated\"\:.*)"

and

|rex field=_raw "(?<before>.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(?<after>\"ResultsTruncated\"\:.*)"
|eval _raw=before+""+after

[richgalloway]

Something must be different.  If not the configuration then something else.  Could the format of the data have changed since Friday?  Perhaps a change was made on the source over the weekend.

[richgalloway]

So the key is to find out what changed since Friday.  Use btool to verify the configuration is still in place on your indexers/heavy forwarders.

[payal4296]

But nothing have changed, the configurations are same in btool.

[payal4296]

Yes have restarted the splunk service after applying changes to the conf files. 

Actually it did worked on Friday ,the day changes were applied but it is not working after that .

[richgalloway]

Recall that btool shows the configuration on disk. Did you restart Splunk after changing the config files?