I am looking for replacing all the numbers in a field to *. Can anyone help.

[Tejagorantla]

Input field value: "this error occured for member123456. While making a payment of 60"
Desired input field value:"this error occured for member*. While making a payment of *"

[acharlieh]

If you're looking for a search time solution instead of index time, one option might be rex in sed mode.

e.g.

<base search> | rex field=fieldname mode=sed "s|\d+|*|g"

[woodcock]

Like this in props.conf on your HF/Indexer tier:

[YourSourcetypeHere]
SEDCMD-obfuscate_membernumber_and_payment = s/this error occurred for member[^\.]\.\s+ While making a payment of \d+/this error occured for member\*\. While making a payment of \*/