Cannot anonymise data at search time in splunk

Question

I have a log file (/var/log/test2.log):

[2022-03-25 14:30:08] LoggerTest.INFO: JSON Request to MySystem {"shopperEmail":"my.email@gmail.com"}

I have $SPLUNK_HOME/etc/system/local/props.conf:

[source::/var/log/test2.log] 
TRANSFORMS-anonymize = shopperEmail_anonymizer

I have $SPLUNK_HOME/etc/system/local/transforms.conf:

[shopperEmail_anonymizer] 
REGEX = (.*)shopperEmail\":\"(.*)\" 
FORMAT = $1shopperEmail: XXX 
DEST_KEY = _raw

I have $SPLUNK_HOME/etc/system/local/inputs.conf:

[monitor:///var/log]
disabled = 0
index=index_name
sourcetype=my_source_type

But when I do a search, shopperEmail is not anonymised. I expect the event to look in splunk like:

[2022-03-25 14:30:08] LoggerTest.INFO: JSON Request to MySystem {"shopperEmail":"**"}

Could you please advise what is wrong? I have tried a lot of options, but neither worked. Thank you in advance.

user_2227420 · Answer

Try using SEDCMD, instead. I've found it to be simpler and more reliable.

In props.conf:

[source::/var/log/test2.log]
SEDCMD-anonShopper = s/shopperEmail\":\"(.*)\"/shopperEmail":"XXX"/

user_2760693 · Answer

I used the wrong forwarder type for this