Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
To mask the first three digits of the AcctID field and replace them with 'xxx', while retaining the last four digits, the correct sed substitution regex should capture the first three digits and the last four digits separately. The regex 'AcctID=\d{3}(\d{4})' captures the last four digits in a capture group. In the replacement part 'AcctID=xxx\1', 'xxx' replaces the first three digits, and '\1' inserts the captured last four digits. Therefore, the correct SEDCMD is 'SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g'.
should be D. the \1 indicates the capture group, should come after the xxx not before
Confirmed via Splunk docs https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Anonymizedata Scrolling down to the section titled "Define the sed script in props.conf shows the correct syntax of an example which validates that the number/character /1 immediately preceded the /g
"SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g" follows the SEDCMD rule "s/<regex>/<replacement>/<flags>" In this case we are re-writing AcctID with three 'x', appending then the first (and only one) capture group, made of 4 digits
Right answer is D