+1 @jrodman for the suggesting the trick to replace _raw. It does not mask the data in source data, however, it does help us to mask the data in search raw events output. For e.g. to mask the value of field "value", you can mask the data in the raw events and the extracted/selected fields which are the most visible views.
....
| eval _raw=replace(_raw,"(value=)[0-9]*","\1xxxx")
| eval value=replace(value,".*","xxxx")
...
... View more