Splunk Search

Anonymize data

splunk_learner
Explorer

Hi,
I have a log
Audit:[timestamp=01-31-2013 11:51:21.164,user=admin,action=search,info=granted REST: /search/jobs/1359613261.13]

Suppose I want to mask user name, I made following configuration
trasnforms.conf
[demo]
REGEX = (?i)^(.*?)user=\w+
FORMAT = $1user=######$2
DEST_KEY = _raw

props.conf
[sourcename]
TRANSFORMS-anonymize = demo
NO_BINARY_CHECK = 1
pulldown_type = 1

But I am getting output as
Audit:[timestamp=01-31-2013 11:51:21.164,user=######$2

I am not able to figure out that why $2 is not wokring and i am not getting the event after regex. Is something wrong with regex?
I hope splunk experts can help me out here

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

you are missing the second matching group for the rest of the line
try

REGEX = (?i)^(.*?)user=\w+(.*)$

and if you really want to decompose the whole event, it could be like :

[demo]
REGEX = (?i)^(.*?)(user=)(\w+)(.*)$
FORMAT = $1$2######$3
DEST_KEY = _raw

View solution in original post

yannK
Splunk Employee
Splunk Employee

you are missing the second matching group for the rest of the line
try

REGEX = (?i)^(.*?)user=\w+(.*)$

and if you really want to decompose the whole event, it could be like :

[demo]
REGEX = (?i)^(.*?)(user=)(\w+)(.*)$
FORMAT = $1$2######$3
DEST_KEY = _raw

View solution in original post

splunk_learner
Explorer

done.thanks for the help 🙂

yannK
Splunk Employee
Splunk Employee

Once logged in you should see an empty grey checkmark on the left, you can click it to turn it green, it will accept the answer, you are welcome.

splunk_learner
Explorer

Sorry for silly question but how do we accept an answer

0 Karma

yannK
Splunk Employee
Splunk Employee

if this worked, you should accept the answer. (karma karma karma)

splunk_learner
Explorer

Thanks it worked and cleared my concept also.

0 Karma