Splunk Search

How to create a regex expression to mask the input?

poddraj
Explorer

Hi,
Can someone help with regex expression to mask the below kind of pattern. I need this pattern of text to be masked wherever I find it in my events.

12/KQXA/123456/ABXY --> **************ABXY 
11/VAXA/123456    /VAQY --> **************VAQY 
00/LCXA/545232/GYFT --> **************GYFT 
0 Karma

manjunathmeti
Champion

Try this query:

| makeresults | eval _raw="12/KQXA/123456/ABXY --> SPLUNKAAAAAAAAABXY" | append [| makeresults | eval _raw="11/VAXA/123456/VAQY      --> AAXZAAAAAAAAAAVAQY" ] | append [| makeresults | eval _raw="00/LCXA/545232/GYFT --> A1AAAAAX50AAAAAGYFT"] | rex field=_raw mode=sed "s/\w{14}/***************/g"
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...