i want to keep the SSED_BUS-number as it is and i want mask other number and email id

[DataOrg]

SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com

example

SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-XXXXX
SSED-BUS-13583 master XXXX
SSED-983-12u85 XXXXX

[harsmarvania57]

Hi @premranjithj,

Please try below run anywhere search

| makeresults 
| eval _raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=_raw mode=sed "s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g"

So your query will be

<yourBasesearch> | rex field=_raw mode=sed "s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g"

If you want to mask data at indextime then please do below configuration in props.conf on Indexer/HeavyForwarder whichever comes first.

[yoursourcetype]
SEDCMD-maskall = s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g

[mayurr98]

Try this

To get master id 1-XXXXX

| makeresults 
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/master\sid\s1-.*/master id 1-XXXX/g"

To get master XXXX

| makeresults 
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/master\s\d+/master XXXX/g"

to mask abc@gmail.com

| makeresults 
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/((\w[\w\-\.]+@\w+.com))(.*)/XXXX/g"

let me know if this helps you!