Hi,
I want to mask or replace all the words in my file with some specific word.
EX:Myfile.csv
"My splunk architecture consists of 5 servers"
I want all the words in Myfile.csv to be replaced like below
"splunk splunk splunk splunk splunk splunk splunk"
Currently using the below props.conf
[sourcetype]
SEDCMD-replace_words_with_splunk = s/\S++/splunk/
But only first word of my file is getting replaced
Could anyone suggest me a way to capture all words in my file and replace all the words with any other word before indexing?
Hi @Ashwini008 .. may we know if you update the props.conf in UF or HF or indexer?
the SEDCMD will work only on HF/indexer(not UF props.conf).
after updating the props.conf, you will need to restart the splunk service.
try to match with "\w" (matches one word):
[sourcetype]
SEDCMD-replace_words_with_splunk = s/\w/splunk/g
[ __auto__learned__ ]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SED-CMD-replace=s/\S+/splunk/g
SEDCMD-replace_all_words=s/\S+/splunk/g
Hi @Ashwini008 i think the sed command flag ("g" for global.. all matches) is missing, pls try this:
[sourcetype]
SEDCMD-replace_words_with_splunk = s/\S++/splunk/g
@inventsekar It didnt work.I tried adding 'g' it still captured only first word of my file and replaced it with word 'splunk'
Hi @Ashwini008 .. may we know if you update the props.conf in UF or HF or indexer?
the SEDCMD will work only on HF/indexer(not UF props.conf).
after updating the props.conf, you will need to restart the splunk service.
try to match with "\w" (matches one word):
[sourcetype]
SEDCMD-replace_words_with_splunk = s/\w/splunk/g
@inventsekar Our server is a standalone server hence had placed it under etc/apps/search/local/props.conf.
The below suggested props.conf is working as required!Thank you!