Splunk Search

Using transforms and props to search and replace multiple fields in an event

brettcave
Builder

If I have an event that looks like this:

META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})

And I want to use a single transforms to replace the values for foo, color and size, to produce logs like:

META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})

I wanted to use the following in transforms, but it's only replacing the first field:

REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3

It only masks the first value, how would I match multiple values?

Sample log output

    META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, Karma would be appreciated.

brettcave
Builder

thanks @richgalloway , am testing this now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Still testing? If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

GindiKhangura
Explorer

@brettcave,

Legend has it that @richgalloway is still looking for that upvote.

0 Karma

brettcave
Builder

accepted answer.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...