Getting Data In

Mask a Credit Card from a CSV file using transforms and props files

cesar_tomas
Explorer

Hi Everyone,

I am new at masking data and I want to mask a field wich corresponds to a TDC from a CSV file.

Here are sample of data that is already indexed in Splunk:

10,I,T10,4152312098821234,05/05/2018,12:43:12 a. m.," $1,000.00 "
19,R,T19,4152312098348591,05/05/2018,09:43:12 a. m.," $1,900.00 "

If you look the third field is the credit card number.

I have set the next things in Transforms.conf

[tdc-anonymizer]
REGEX = ^(?:[^,\n]*,){3}
FORMAT = \d{4}########\d{4}
DEST_KEY = _raw

I have set the next in propf.conf

[csv]
REPORT-anonymize = tdc-anonymizer

But it does not work, can anyone please help me ??

I have also try this pair of options in transforms.conf but do not work too

[tdc-anonymizer]
REGEX = ^(?:[^,\n]*,){3}$
FORMAT = $1\d{4}########\d{4}$2
DEST_KEY = _raw

[tdc-anonymizer]
REGEX = ^(?:[^,\n]*,){3}$(?P\d{16})
FORMAT = $1\d{4}########\d{4}$2
DEST_KEY = _raw

Thanks in advance

0 Karma

harsmarvania57
Ultra Champion

Do you want to mask already indexed data or you want to mask new data which will ingest into splunk ? If you want to mask already indexed data then it is not possible because you can't alter indexed data in bucket.

0 Karma

cesar_tomas
Explorer

I forgot to mention that I want the format like the 4 digits of the credit card visible and the last 4 digits too.

Example of the first occurrency

HOw is it now: 4152312098821234
How i want it: 4152########1234

Regards

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...