https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310716#M166292 <P>Thanks Somesoni2</P> Thu, 31 Aug 2017 02:00:22 GMT splunker969 2017-08-31T02:00:22Z https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310714#M166290 <P>How to write search query to find from particular host is sending any credit card data into splunk by using regex ?<BR /> Discover card<BR /><BR /> dinerclub<BR /> mastercard<BR /> visa </P> <P>index=* host =X|regex="(4[0-9]{14})|(5[1-5][0-9]{14})</P> <P>Please help me in query </P> Thu, 31 Aug 2017 01:22:13 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310714#M166290 splunker969 2017-08-31T01:22:13Z https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310715#M166291 <P>You can use the regex used in below link. <A href="https://wiki.splunk.com/Community:Credit_card_masking_regex">https://wiki.splunk.com/Community:Credit_card_masking_regex</A><BR /> The filtering query can be like this</P> <PRE><CODE>index=* host =X|regex _raw="&gt;+REGEXfromABOVElink" </CODE></PRE> <P>OR</P> <PRE><CODE>index=* host =X|where match(_raw,"REGEXfromABOVElink") </CODE></PRE> Thu, 31 Aug 2017 01:35:02 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310715#M166291 somesoni2 2017-08-31T01:35:02Z https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310716#M166292 <P>Thanks Somesoni2</P> Thu, 31 Aug 2017 02:00:22 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-help/m-p/310716#M166292 splunker969 2017-08-31T02:00:22Z