Splunk Search

Regex & File Directory Path

behymejt2012
Path Finder

Hi Everyone,

Need a little help with regexing out a portion of a directory path. The examples below are the current structure of paths that I have (the user account is always 9 digits long):

c:\users\123456789\desktop\

c:\users\123456789\documents\

c:\users\123456789\desktop\files

c:\users\987654321\pictures\

the goal is to remove the section "123456789" section from the directory.

Any help or guidance would be greatly appreciated.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In order to anonymize the source field you need to change index-time settings in props.conf and transforms.conf. Here's the relevant doc: http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments (Note: This works with the host field, but the approach is the same.

As for the specifics, you'll likely need a custom REGEX and FORMAT like this:

REGEX = ^source::(.*)/\d{9}(.*)$
FORMAT = source::$1$2

I didn't test these expressions.

0 Karma

gfuente
Motivator

Hello

Try this regex:

\w\:\\users\\\d+(?<yourfield>\\[^\r]*)$

Maybe you need to substitute the \r of the end of the rex by \n or \R

Regards

0 Karma

behymejt2012
Path Finder

@martin_muller that would work as well. The goal is to hide/anonymize the users id

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is this the source field, and you want to anonymize the user id?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Not sure what you want to do with the section of numbers.But maybe something like this:

your_search |rex field=_raw "C:\\users\\(?<user_id>\d{9})\\" | stats count by user_id

Does that help?

alacercogitatus
SplunkTrust
SplunkTrust

So to remove data do this in props and transforms, requires restart.

props.conf
[source::C:\\users\\*]
TRANSFORMS-hide = hide_users_path

transforms.conf
[hide_users_path]
REGEX = source::C:\\users\\\d+\\(.*)
FORMAT = source::$1
SOURCE_KEY = Metadata:Source
DEST_KEY = Metadata:Source
WRITE_META = TRUE

0 Karma

behymejt2012
Path Finder

Not exactly. ideally it would be best to only have everything after user/123456789.

0 Karma

behymejt2012
Path Finder

Looks like the submission took out all the \

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...