Hi Splunkies, I have configured a transforms.conf below: [ABCD] REGEX = (?m)^(.*)("ABCD":")(\w+(\w{4}["].*)) FORMAT = $1$2xxxxx$4 DEST_KEY = _raw Together with a props.conf below: [host::] TRANSFORMS- ABCD = ABCD The logs that I have below is: "ABCD":"A1234567A", "ABCD":"A1234567B", "ABCD":"A1234567C" And I intent to change to "ABCD":"xxxxx567A", "ABCD":"xxxxx567B", "ABCD":"xxxxx567C" However, the above configuration only allows the logs to be anonymize with the following: "ABCD":"A1234567A", "ABCD":"A1234567B", "ABCD":"xxxxx567C" I have tried on https://regex101.com/, and there seems to be a global flag that will allow me to achieve my intended anonymizing. Will greatly appreciate if any of you have gone through the same, and able to apply a global flag on the REGEX in transforms.conf ... View more