Masking an email address at the search head level

[joe06031990]

• Good afternoon,
• I am trying to Masking an email address at the search head level I have tried using Rex and sed but can’t get it to work, does anyone have any examples?
•  
• thanks 
•  
• Joe 
•  

[to4kawa]

https://community.splunk.com/t5/Getting-Data-In/Anonymize-data-from-JSON-File/td-p/502195?childToVie...

how about my updated answer? or

| makeresults
| eval _raw="2020-07-06 sender=foo@bar.com recipient=baz@bar.co.jp subject=\"test only\""
| rex mode=sed "s/[\w\-\.]+@[\w\-\.]+/XXXXX/g"

[joe06031990]

Thanks for your reply, is their a regex I could use? As this is only at the search head level.

[to4kawa]

@joe06031990     I'm not sure what you say "search head level".

1. If you want to mask logs, see my link and try logic.

2. If you want to mask on dashboard, try rex