https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170059#M186300 <P>you can refer <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles">here</A>, using SEDCMD , REGEX in props.conf and transforms.conf file in $SPLUNK_HOME/etc/system/local/ directory</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles</A></P> Mon, 29 Dec 2014 16:14:09 GMT sgundeti 2014-12-29T16:14:09Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170055#M186296 <P>Sample:<BR /> 1234/rani/abc1234/dfh<BR /> Need to get output as <CODE>*/rani/*/dfh</CODE></P> Sun, 28 Dec 2014 06:22:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170055#M186296 viswanathsd 2014-12-28T06:22:07Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170056#M186297 <P>1234 should be replace by wild character</P> Sun, 28 Dec 2014 06:27:49 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170056#M186297 viswanathsd 2014-12-28T06:27:49Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170057#M186298 <P>Use an eval expression. Something like this should do it.</P> <PRE><CODE>replace(yourfield,"([^/]+)/([^/]+)/([^/]+)/([^/]+)","*/\2/*/\4") </CODE></PRE> Sun, 28 Dec 2014 09:36:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170057#M186298 Ayn 2014-12-28T09:36:20Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170058#M186299 <P>Thanks for your response.But i need to know,how can I implement this in Data MOdel?</P> Mon, 29 Dec 2014 15:17:15 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170058#M186299 viswanathsd 2014-12-29T15:17:15Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170059#M186300 <P>you can refer <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles">here</A>, using SEDCMD , REGEX in props.conf and transforms.conf file in $SPLUNK_HOME/etc/system/local/ directory</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles</A></P> Mon, 29 Dec 2014 16:14:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170059#M186300 sgundeti 2014-12-29T16:14:09Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170060#M186301 <P>Like @Ayn wrote, use an eval expresion in your data model. Look at the docs for more details <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Definedatamodelattributes">http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Definedatamodelattributes</A></P> Tue, 30 Dec 2014 20:25:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170060#M186301 MuS 2014-12-30T20:25:43Z https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170061#M186302 <P>To make this work via "add eval", you'd need to create a new field with a different name in the data model and hide the old field. The display name can be whatever you'd like.</P> <P>Another option is to do that eval in a root search -&gt; Add object -&gt; Root search.</P> Thu, 04 Jun 2015 21:03:08 GMT https://community.splunk.com/t5/Splunk-Search/how-to-mask-data-in-data-model/m-p/170061#M186302 mrobichaud_splu 2015-06-04T21:03:08Z