Regex & File Directory Path

[behymejt2012]

Hi Everyone,

Need a little help with regexing out a portion of a directory path. The examples below are the current structure of paths that I have (the user account is always 9 digits long):

c:\users\123456789\desktop\

c:\users\123456789\documents\

c:\users\123456789\desktop\files

c:\users\987654321\pictures\

the goal is to remove the section "123456789" section from the directory.

Any help or guidance would be greatly appreciated.

[martin_mueller]

In order to anonymize the source field you need to change index-time settings in props.conf and transforms.conf. Here's the relevant doc: http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments (Note: This works with the host field, but the approach is the same.

As for the specifics, you'll likely need a custom REGEX and FORMAT like this:

REGEX = ^source::(.*)/\d{9}(.*)$
FORMAT = source::$1$2

I didn't test these expressions.

[gfuente]

Hello

Try this regex:

\w\:\\users\\\d+(?<yourfield>\\[^\r]*)$

Maybe you need to substitute the \r of the end of the rex by \n or \R

Regards

[behymejt2012]

@martin_muller that would work as well. The goal is to hide/anonymize the users id

[martin_mueller]

Is this the source field, and you want to anonymize the user id?

[alacercogitatus]

Not sure what you want to do with the section of numbers.But maybe something like this:

your_search |rex field=_raw "C:\\users\\(?<user_id>\d{9})\\" | stats count by user_id

Does that help?

[alacercogitatus]

So to remove data do this in props and transforms, requires restart.

props.conf
[source::C:\\users\\*]
TRANSFORMS-hide = hide_users_path

transforms.conf
[hide_users_path]
REGEX = source::C:\\users\\\d+\\(.*)
FORMAT = source::$1
SOURCE_KEY = Metadata:Source
DEST_KEY = Metadata:Source
WRITE_META = TRUE

[behymejt2012]

Not exactly. ideally it would be best to only have everything after user/123456789.

[behymejt2012]

Looks like the submission took out all the \