how to mask data in data model?

[viswanathsd]

Sample:
1234/rani/abc1234/dfh
Need to get output as */rani/*/dfh

[sgundeti]

you can refer here, using SEDCMD , REGEX in props.conf and transforms.conf file in $SPLUNK_HOME/etc/system/local/ directory

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Anonymizedatausingconfigurationfiles

[viswanathsd]

Thanks for your response.But i need to know,how can I implement this in Data MOdel?

[MuS]

Like @Ayn wrote, use an eval expresion in your data model. Look at the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Definedatamodelattributes

[Ayn]

Use an eval expression. Something like this should do it.

replace(yourfield,"([^/]+)/([^/]+)/([^/]+)/([^/]+)","*/\2/*/\4")

[mrobichaud_splu]

To make this work via "add eval", you'd need to create a new field with a different name in the data model and hide the old field. The display name can be whatever you'd like.

Another option is to do that eval in a root search -> Add object -> Root search.

[viswanathsd]

1234 should be replace by wild character