How do you handle multiple sanitizations in the same regex?

[zhatsispgx]

Hi all,

I have the following data being indexed by splunk:

POST /somendpoint.asmx HTTP/1.1
Host: somehost
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE/"
Content-Length: 638
Authorization: Basic 123asdf1234asdf1234asdf=

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV> SOAPSTUFFHERE </SOAP-ENV:Envelope>
POST /SOMEENDPOINT.asmx HTTP/1.1
Host: SOMEHOST
Connection: Keep-Alive
User-Agent: YAY
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://URLHERE"
Content-Length: 638
Authorization: Basic ###########REDACTED###########=

I have the following in /opt/splunk/etc/system/local/transforms.conf

[httpbasicauth-anonymizer]
REGEX = (?m)^(.*)Authorization:\sBasic\s\w+(.*)$
FORMAT = $1Authorization: Basic ###########REDACTED###########$2
DEST_KEY = _raw

and ./props.conf

[mysourcetype]
TRANSFORMS-anonymize = httpbasicauth-anonymizer

As you can see, only the last match in the data is being sanitized. How do you handle multiple sanitizations in the same regex?
I thought (?m) being multiline would handle this.

Thanks!

[cpetterborg · Accepted solution]

It is easier to use SEDCMD in the props.conf file than using TRANSFORMS and a transforms.conf file. Here is what I would do:

props.conf:

SEDCMD-obfuscatepwd=s/Authorization:\sBasic\s\w+/Authorization: Basic  ###########REDACTED###########/g

That will do multiple instances and it only has to be done in one file instead of two.

[zhatsispgx]

will test this out. thx!