Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21]
VendorID=1234 Code=B AcctID=xxx5309
Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

Question

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21]

VendorID=1234 Code=B AcctID=xxx5309

Event:

[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

souhaib chabchoub · Accepted Answer

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

souhaib chabchoub · Answer

SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g

souhaib chabchoub · Answer

SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g

souhaib chabchoub · Answer

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 54 - SPLK-1003 discussion

Suggested answer: D

0 comments