Thats great. Alternatively you could use | rex field=kreditnakatica mode=sed "s/(\d{12})/XXXXXXXXXXXX/g" ... View more

I only had to kodify it slightly to [xmltest2] LINE_BREAKER = ([\r\n]*)<ENTRY> NO_BINARY_CHECK = 1 TIME_FORMAT = %Y-%m-%dT%H:%M:%S TIME_PREFIX = VRIJEME> ... View more

Hi @skansi Glad you found what you needed through Damien! If a user gives you an answer that solves your question, please accept their answer by clicking on the big check mark next to their response. This will mark the post as Answered and can serve as a reliable source for people with similar issues, thus helping the entire Splunk community 🙂 Patrick ... View more