Hello, I was wondering could anyone help me figure out the sed script required and regex to Anonymize child nodes from xml - The difficulty seems to be due to the fact each node takes it's own line within splunk rather than usual single line <testfield> 123 </testfield> . Here is an example of how it appears: <userDetails> <name> <testfield> 123 </testfield> </name> </userDetails> And the appearance I would want would be something like: <userDetails> <name> <testfield> xxxx </testfield> </name> </userDetails> Any help would be great with this - thank you. James ... View more

Hey, I am running a local instance of splunk for testing purposes. The aim is toAnonymize certain parts of the data that can be searched. In my files there were no props.conf or transforms.conf so I created these two files in this folder 'C:\Program Files\Splunk\etc\system\local' The data I am looking to anonymize is simple testfield: 123 - Either by removing it completely or removing the unit. If anyone could help with what exactly should go in the transforms.conf and the props.conf files that would be greatly appreciated. Thank you, ... View more