Splunk Search

Using transforms and props to search and replace multiple fields in an event

brettcave
Builder

If I have an event that looks like this:

META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})

And I want to use a single transforms to replace the values for foo, color and size, to produce logs like:

META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})

I wanted to use the following in transforms, but it's only replacing the first field:

REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3

It only masks the first value, how would I match multiple values?

Sample log output

    META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

brettcave
Builder

thanks @richgalloway , am testing this now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Still testing? If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

GindiKhangura
Explorer

@brettcave,

Legend has it that @richgalloway is still looking for that upvote.

0 Karma

brettcave
Builder

accepted answer.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...