Anonymize data

[splunk_learner]

Hi,
I have a log
Audit:[timestamp=01-31-2013 11:51:21.164,user=admin,action=search,info=granted REST: /search/jobs/1359613261.13]

Suppose I want to mask user name, I made following configuration
trasnforms.conf
[demo]
REGEX = (?i)^(.*?)user=\w+
FORMAT = $1user=######$2
DEST_KEY = _raw

props.conf
[sourcename]
TRANSFORMS-anonymize = demo
NO_BINARY_CHECK = 1
pulldown_type = 1

But I am getting output as
Audit:[timestamp=01-31-2013 11:51:21.164,user=######$2

I am not able to figure out that why $2 is not wokring and i am not getting the event after regex. Is something wrong with regex?
I hope splunk experts can help me out here

[yannK · Accepted solution]

you are missing the second matching group for the rest of the line
try

REGEX = (?i)^(.*?)user=\w+(.*)$

and if you really want to decompose the whole event, it could be like :

[demo]
REGEX = (?i)^(.*?)(user=)(\w+)(.*)$
FORMAT = $1$2######$3
DEST_KEY = _raw


[splunk_learner]

done.thanks for the help 🙂

[yannK]

Once logged in you should see an empty grey checkmark on the left, you can click it to turn it green, it will accept the answer, you are welcome.

[splunk_learner]

Sorry for silly question but how do we accept an answer

[yannK]

if this worked, you should accept the answer. (karma karma karma)

[splunk_learner]

Thanks it worked and cleared my concept also.