Splunk Search

SED command on props

ranjitbrhm1
Communicator

Good Day all. I am trying to replace a last name using SED command on my props.
my data looks like below.
asdfa asdf first last asdf
asdf asdf first last asdf
asdf asdf first last asdf

My props looks like below

[mymask]
DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
SEDCMD-ranjit=s/\w+\s\w+\s(\w+\s)\w+/\1XXXXXXXX/g

When i upload the data into splunk my data is looking like below

first XXXXXXXX asdf
first XXXXXXXX asdf
first XXXXXXXX asdf

So basically it replaced the entire data before the pattern with the capture group and the modification which is the XXXX. i could capture the whole data as a capture group and replace them but i am looking for options where i can just replace the capture group with the modification.
so that my data looks like

asdf asdf first XXXXX asdf
Tags (3)
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

There are several things wrong with the SEDCMD. Try:

SEDCMD-ranjit=s/^(\w+\s\w+\s\w+\s)(\w+)/\1XXXXXXXX/g

That should do what you want.

0 Karma

FrankVl
Ultra Champion

@ranjitbrhm1 as mentioned on Slack, if it is indeed always the 4th word that needs to be masked, this should do the trick.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Can you post a better example of your data, your sample tells us nothing about the data and what you are attempting to replace. If we could see more, we could suggest a better SED expression for you to use.

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...