Splunk Search

Anonymize data

splunk_learner
Explorer

Hi,
I have a log
Audit:[timestamp=01-31-2013 11:51:21.164,user=admin,action=search,info=granted REST: /search/jobs/1359613261.13]

Suppose I want to mask user name, I made following configuration
trasnforms.conf
[demo]
REGEX = (?i)^(.*?)user=\w+
FORMAT = $1user=######$2
DEST_KEY = _raw

props.conf
[sourcename]
TRANSFORMS-anonymize = demo
NO_BINARY_CHECK = 1
pulldown_type = 1

But I am getting output as
Audit:[timestamp=01-31-2013 11:51:21.164,user=######$2

I am not able to figure out that why $2 is not wokring and i am not getting the event after regex. Is something wrong with regex?
I hope splunk experts can help me out here

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

you are missing the second matching group for the rest of the line
try

REGEX = (?i)^(.*?)user=\w+(.*)$

and if you really want to decompose the whole event, it could be like :

[demo]
REGEX = (?i)^(.*?)(user=)(\w+)(.*)$
FORMAT = $1$2######$3
DEST_KEY = _raw

View solution in original post

yannK
Splunk Employee
Splunk Employee

you are missing the second matching group for the rest of the line
try

REGEX = (?i)^(.*?)user=\w+(.*)$

and if you really want to decompose the whole event, it could be like :

[demo]
REGEX = (?i)^(.*?)(user=)(\w+)(.*)$
FORMAT = $1$2######$3
DEST_KEY = _raw

splunk_learner
Explorer

done.thanks for the help 🙂

yannK
Splunk Employee
Splunk Employee

Once logged in you should see an empty grey checkmark on the left, you can click it to turn it green, it will accept the answer, you are welcome.

splunk_learner
Explorer

Sorry for silly question but how do we accept an answer

0 Karma

yannK
Splunk Employee
Splunk Employee

if this worked, you should accept the answer. (karma karma karma)

splunk_learner
Explorer

Thanks it worked and cleared my concept also.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...