Index time masking maintaining string length (continue)

[payl_chdhry]

Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/51...

I have same requirement but for different  format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet.

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456                 " 1 240

should give me:

2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX                 " 1 240

[thambisetty]

you have shared only one sample event. I have added few more digits to change length and see my regex is working or not. and also it mask only 4 digits always.

[yoursourcetype]
SEDCMD=s/(\"\d{3,})(\d{4})/\1****/g

[to4kawa]

s/(\"\d+)(\d{4})/\1####/