Hello we are trying to mask an account#'s last 5 digits. I have added this to props.conf
[annon]
TRANSFORMS-anonymize = hideacct-number
and this to transforms.conf
[hideacct-number]
REGEX=(.*AcctCode=\d{5}-).*
FORMAT=$1xxxxx
I stopped splunk and cleaned the index and then started it again and the account numbers are still there completely. What are we missing?
Update: I am using 4.2.3 and I am trying to mask the last 5 characters with X's. I am trying JSapienza's answer now and will keep you posted. Thanks!
Update2: That did not help. It does not change my data. I tried REPORT as well with the same results.
... View more