before i go further, your search is very heavy as it calculates all data and hashes user, if you want to mask the user field, you can do it at index time with
tranforms.conf also, check out the new feature in Splunk 8.0 around work with data before its indexed
i think the closest to what you are after is: "search filters" however, although they have some downsides,
there is another doc that i cant find at the moment.
regardless, i think that what @kamlesh_vaghela suggested (macros) is a better solution, as you will can also put variables in them and they are knowledge objects and not roles configuration.
hope it helps
I think it is not possible. But to achieve this, you have to create a
macro with below search which can be use in all searches.
| eval _raw=split(_raw, user) | eval user_hash=sha256(user) | eval _raw=mvjoin(_raw, user_hash)
search index=main `my_macro`