SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com
example
SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-XXXXX
SSED-BUS-13583 master XXXX
SSED-983-12u85 XXXXX
Hi @premranjithj,
Please try below run anywhere search
| makeresults
| eval _raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=_raw mode=sed "s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g"
So your query will be
<yourBasesearch> | rex field=_raw mode=sed "s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g"
If you want to mask data at indextime then please do below configuration in props.conf on Indexer/HeavyForwarder whichever comes first.
[yoursourcetype]
SEDCMD-maskall = s/(?m)(master)(.+)?(\s+)(\S+)$/\1\2\3####/g
Try this
To get master id 1-XXXXX
| makeresults
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/master\sid\s1-.*/master id 1-XXXX/g"
To get master XXXX
| makeresults
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/master\s\d+/master XXXX/g"
to mask abc@gmail.com
| makeresults
| eval raw="SSED-BUS-0123 the package is failed to accept
SSED-BUS-1466 master id 1-fjdfh23
SSED-BUS-13583 master 85793
SSED-BUS-13583 master abc@gmail.com"
| rex field=raw mode=sed "s/((\w[\w\-\.]+@\w+.com))(.*)/XXXX/g"
let me know if this helps you!