i just want to extract the number from the below sentance and replace with xxxx . Help me

[DataOrg]

the Information in service : ID R1-7857hi75 is duplicated

i want to make it as
the Information in service : ID R1-******* is duplicated

[harsmarvania57 · Accepted solution]

Hi @premranjithj,

If you want to anonymise during search time you use below query

< your search> | rex mode=sed "s/(?m)(\-)(\w+)/\1xxx/g

If you want to anonymise value during index time, please add below config on props.conf in Indexer or Heavy Forwarder whichever comes first.

props.conf

[yoursourcetype]
SEDCMD-maskvalue = s/(?m)(\-)(\w+)/\1xxx/g

I hope this helps.

Thanks,
Harshil

[DataOrg]

@harsmarvania57. thanks its worked.
can you please explain me the expression. i just want to understand to form other expression

[harsmarvania57]

I am using sed mode in rex so in expression format is s/regexp/replacement/flags, in this format s means substitute then regex (?m)(\-)(\w+) (This will find data in (?m)->multiline with pattern - (-) in first capturing group (\w+) means word with any length in second capturing group) and replacement is \1xxx (Which will replace 2nd capturing group with xxx) and flag is g (Apply the replacement to all matches to the regexp, not just the first.)

For more explanation and play with regex with your sample data please refer https://regex101.com/r/HHefSs/1

Please accept my answer and upvote it, as it worked for you.

[DataOrg]

@harsnarvania57. thanks much for making me to understand. its really good