https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400844#M116094 <P>Like this in props.conf on your HF/Indexer tier:</P> <PRE><CODE>[YourSourcetypeHere] SEDCMD-obfuscate_membernumber_and_payment = s/this error occurred for member[^\.]\.\s+ While making a payment of \d+/this error occured for member\*\. While making a payment of \*/ </CODE></PRE> Sun, 07 Apr 2019 23:09:13 GMT woodcock 2019-04-07T23:09:13Z https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400843#M116093 <P>Input field value: "this error occured for member123456. While making a payment of 60"<BR /> Desired input field value:"this error occured for member*. While making a payment of *"</P> Sun, 07 Apr 2019 22:32:00 GMT https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400843#M116093 Tejagorantla 2019-04-07T22:32:00Z https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400844#M116094 <P>Like this in props.conf on your HF/Indexer tier:</P> <PRE><CODE>[YourSourcetypeHere] SEDCMD-obfuscate_membernumber_and_payment = s/this error occurred for member[^\.]\.\s+ While making a payment of \d+/this error occured for member\*\. While making a payment of \*/ </CODE></PRE> Sun, 07 Apr 2019 23:09:13 GMT https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400844#M116094 woodcock 2019-04-07T23:09:13Z https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400845#M116095 <P>If you're looking for a search time solution instead of index time, one option might be <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Rex">rex</A> in sed mode. </P> <P>e.g. </P> <PRE><CODE>&lt;base search&gt; | rex field=fieldname mode=sed "s|\d+|*|g" </CODE></PRE> Mon, 08 Apr 2019 06:17:39 GMT https://community.splunk.com/t5/Splunk-Search/I-am-looking-for-replacing-all-the-numbers-in-a-field-to-Can/m-p/400845#M116095 acharlieh 2019-04-08T06:17:39Z