Problem anonymizing data in Splunk

[justynap_ldz]

We want to anonymize the usernames in the following event using sed script.

Raw event:

{"externalId": null, "statusChanged": "2021-02-09T09:51:42.000Z", "userName": "[email protected] ", "appid": "0oa97rn2ymPrbgM430x612344", "lastUpdated": "2021-02-09T09:51:42.000Z", "scope": "", "userid": "00u1a2mn8ouOvSO2A0x71234", "created": "2021-02-09T09:51:42.000Z", "status": "ACTIVE"}

However, either the stanza in props.conf is incorrect or we did it in the wrong place.

Current config:
1. input is specified on a Heavy Forwarder in an app local folder (we just activated inputs after installing an app in the FrontEnd and that is how this entry was created)
2. we added the following SEDCMD stanza in /opt/splunk/etc/system/local/props.conf on a Heavy Forwarder: 

[testapp:appUser]
SEDCMD-TestApp_username1=s/userName:(\d{6})/userName:XXXXXX/1

Does anyone have any idea on how to solve it?

[to4kawa]

index=_internal | head 1 | fields _raw
| eval _raw="{\"externalId\": null, \"statusChanged\": \"2021-02-09T09:51:42.000Z\", \"userName\": \"[email protected] \", \"appid\": \"0oa97rn2ymPrbgM430x612344\", \"lastUpdated\": \"2021-02-09T09:51:42.000Z\", \"scope\": \"\", \"userid\": \"00u1a2mn8ouOvSO2A0x71234\", \"created\": \"2021-02-09T09:51:42.000Z\", \"status\": \"ACTIVE\"}"
| rex mode=sed "s/(userName\":\s*\").*@/\1XXXXXX@/"

your SEDCMD is wrong.

[ITWhisperer]

Your user name looks like an e-mail address whereas your sed is looking for 6 digits.