Splunk Search

I am looking for replacing all the numbers in a field to *. Can anyone help.

New Member

Input field value: "this error occured for member123456. While making a payment of 60"
Desired input field value:"this error occured for member*. While making a payment of *"

0 Karma

Influencer

If you're looking for a search time solution instead of index time, one option might be rex in sed mode.

e.g.

<base search> | rex field=fieldname mode=sed "s|\d+|*|g"
0 Karma

Esteemed Legend

Like this in props.conf on your HF/Indexer tier:

[YourSourcetypeHere]
SEDCMD-obfuscate_membernumber_and_payment = s/this error occurred for member[^\.]\.\s+ While making a payment of \d+/this error occured for member\*\. While making a payment of \*/
0 Karma