Alter Splunk Data at Indexing Time

What happened after data altered ???

<username>chandika</username>
<username>******</username>

Where should I do the magic ???

Where should I do the change in Props.conf ???

How I change data??? What are the commands ???

  1. SEDCMD

SEDCMD

s/regexp/replacement/flags/
SEDCMD-_raw = s/([a-zA-Z0-9][a-zA-Z0-9\-\+_\.]*@[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,})/##email##/g
SEDCMD-_raw = s/(USER_DATA.*)([a-zA-Z0-9][a-zA-Z0-9\-\+_\.]*@[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,})/\1##email##/g
SEDCMD-_raw = s/<email>[^<]*<\/email>/<email>****<\/email>/g
SEDCMD-_raw = s/<username>[^<]*<\/username>/<username>****<\/username>/g

EVAL

EVAL-_raw = replace(_raw, "([a-zA-Z0-9][a-zA-Z0-9\-\+_\.]*@[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,})", "#email1#")
EVAL-_raw = replace(_raw, "<email>[^<]*<\/email>", "<email>****<\/email>")
EVAL-_raw = replace(_raw,"<username>[^<]*<\/username>", "<username>@@@@<\/username>")
EVAL-_raw = replace(replace(_raw,"<username>[^<]*<\/username>", "<username>@@@@<\/username>"), "<email>[^<]*<\/email>", "<email>****<\/email>")
EVAL-_raw = if(searchmatch("USER_DATA"),replace(_raw, "([a-zA-Z0-9][a-zA-Z0-9\-\+_\.]*@[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,})", "#email1#"), _raw)

Apply the changes

  1. In web
  • Goto Splunk web
  • Go to Settings > Server Controls
  • Select “Restart Splunk”
$SPLUNK_HOME/bin/splunk restart
http://<splunkserver>:8000/en-US/debug/refresh

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store