How to mask/replace all the words in a file using props.conf?

[Ashwini008]

Hi,

I want to mask or replace all the words in my file with some specific word.

EX:Myfile.csv

"My splunk architecture consists of 5 servers"

I want all the words in Myfile.csv to be replaced like below

"splunk splunk splunk splunk splunk splunk splunk"

Currently using the below props.conf 

[sourcetype]
SEDCMD-replace_words_with_splunk = s/\S++/splunk/

But only first word of my file is getting replaced

Could anyone suggest me a way to capture all words in my file and  replace all the words with any other word before indexing?

[thambisetty]

[ __auto__learned__ ]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SED-CMD-replace=s/\S+/splunk/g
SEDCMD-replace_all_words=s/\S+/splunk/g

[inventsekar]

Hi @Ashwini008 i think the sed command flag ("g" for global.. all matches) is missing, pls try this:

[sourcetype]
SEDCMD-replace_words_with_splunk = s/\S++/splunk/g

[Ashwini008]

@inventsekar It didnt work.I tried adding 'g' it still captured only first word of my file and replaced it with word 'splunk'

[inventsekar · Accepted solution]

Hi @Ashwini008 .. may we know if you update the props.conf in UF or HF or indexer? 

the SEDCMD will work only on HF/indexer(not UF props.conf). 

after updating the props.conf, you will need to restart the splunk service. 

try to match with "\w" (matches one word):

[sourcetype]
SEDCMD-replace_words_with_splunk = s/\w/splunk/g

[Ashwini008]

@inventsekar Our server is a standalone server hence had placed it under etc/apps/search/local/props.conf.

The below suggested props.conf is working as required!Thank you!