Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/51...
I have same requirement but for different format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet.
2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240
should give me:
2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
you have shared only one sample event. I have added few more digits to change length and see my regex is working or not. and also it mask only 4 digits always.
[yoursourcetype]
SEDCMD=s/(\"\d{3,})(\d{4})/\1****/g
s/(\"\d+)(\d{4})/\1####/