Splunk Search

How to create a regex expression to mask the input?

poddraj
Explorer

Hi,
Can someone help with regex expression to mask the below kind of pattern. I need this pattern of text to be masked wherever I find it in my events.

12/KQXA/123456/ABXY --> **************ABXY 
11/VAXA/123456    /VAQY --> **************VAQY 
00/LCXA/545232/GYFT --> **************GYFT 
0 Karma

manjunathmeti
Champion

Try this query:

| makeresults | eval _raw="12/KQXA/123456/ABXY --> SPLUNKAAAAAAAAABXY" | append [| makeresults | eval _raw="11/VAXA/123456/VAQY      --> AAXZAAAAAAAAAAVAQY" ] | append [| makeresults | eval _raw="00/LCXA/545232/GYFT --> A1AAAAAX50AAAAAGYFT"] | rex field=_raw mode=sed "s/\w{14}/***************/g"
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...