Hello Heinz,
yes this is possible.
Where do you want to do this? before indexing?
Than you could do it in your props.conf with an regex like this example:
SEDCMD-ip = s/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.)(\d{1,3})/\1xxx/g
This replaces the last octet in an IP adress.
Or when you want to do it at searchtime you could do it in your Query like this
… | eval callingPartyNumber = replace(callingPartyNumber, "(\d+)(\d{3})", "xxxxx\2")
Output in both ways is 192.168.2.xxx
So you could edit the regexes to fit your needs and replace the not wanted strings with an empty string.
... View more