Unable to mask data using regex expression in XML logfile

[mookiie2005]

I need to mask WILLIAM as seen below:

2015-03-18 10:04:37,453 [WebContainer : 1] INFO  com.farmers.ffq.saq.service.SAQService  - Req for 97995437 Quote: <com.farmers.ffq.saq.webservice.PrefillProspectDataForAutoQuote>
  <requestHeader>
    <userId>FFQ138</userId>
    <functionName>0</functionName>
  </requestHeader>
  <isBILimitSelected>false</isBILimitSelected>
  <isCurrentCarrierSelected>false</isCurrentCarrierSelected>
  <isPDLimitSelected>false</isPDLimitSelected>
  <numberOfCacheDays>-1</numberOfCacheDays>
  <prospectCustomer>
   <firstName>WILLIAM</firstName>

I have been trying to use this regex in my transforms.conf:

[FirstName-anonymizer]
REGEX = (?ms)^(.\*)\<[fF]irstName>\d{1,10}.\*)$
FORMAT = $1##########$2
DEST_KEY = _raw

however, the output from the above eliminates all other data for the record so in Splunk, all you will see for each event is:

$1<firstName>########<firstName>$2

The above was based on the example from:

http://answers.splunk.com/answers/73298/masking-ssn-info-into-splunk-at-index-time.html

I have also looked at:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Anonymizedatausingconfigurationfiles

Can anyone help?

[vincenteous · Accepted solution]

Hi mookiie,

Have you tried your regex pattern at an online regex tester before you applied it to your Splunk configuration? I've tried using your regex pattern with your sample data and I found an error for your pattern [you have ')' before '$', but no '(' to make a complete bracket].

I tried to make a new pattern for your sample data:

(?ms)^(.*\<[fF]irstName\>)\w+(.*)$

Hope it helps.

[mookiie2005]

Thank you so much! This is the first time we have tried to mask data and it was driving me nutz! Again thank you for taking the time to help out a fellow splunker!

[vincenteous]

No problem. Glad to be of any help 🙂