Similar to @woodcock's answer, Splunk 8.1 adds the mvmap function to iterate over multi-valued field values. This makes it easy to replace characters in a string: | makeresults
| eval value="randomize this"
| eval mask=" !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
| eval random_value=mvjoin(mvmap(split(value, ""), substr(mask, random()%len(mask), 1)), "") The replace function and rex command can also be used to mask values, but the replacement value is only evaluated once: | makeresults
| eval value="randomize this"
| eval masked_value=replace(value, ".", "*") | makeresults
| eval value="randomize this"
| rex field=value mode=sed "s/./*/g" Hash functions, lookup tables, and other methods are also useful, depending on why you want to randomize, mask, or deidentify your data.
... View more