Splunk Enterprise

How do I create a Regex that doesn't contain random numbers or timestamps?

Kk
Path Finder

Hi All, I'm trying to find the credit card details in the logs with all in one regex expression. But I was also getting some other data too like timestamp data as it has more than 12digits and some random data. Just bit exhausted with this thing here. Is there any possible solution to find the credit card numbers directly that will not contains random numbers or time stamps. Help me with the query if possible.

Thanks in advance.

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

https://regex101.com/r/eqLFaV/1 

| rex "card>.*?\D?(?<card>\d{16})\<card"

 

View solution in original post

venky1544
Builder

Hi @Kk 

Better solution/suggestions can be provided if you paste some sample/dummy data 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

With regex, it helps to identify some sort of anchor pattern e.g. "card=xxxx". If you don't have this, and you just want to look for strings of 16 digits for example

| rex "\D(?<possiblecard>\d{16})\D"

Kk
Path Finder

Hi @ITWhisperer , actually we are having many anchor patterns to recognise the card details. Example like card>xxxx, text:xxx. So is their any way to find by using generic query?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Regex works with patterns - if you can define what you mean by generic as a pattern, then you might be able to do it in regex. For example, the "generic" pattern is my example is non-digit followed by 16 digits followed by another non-digit. If you know all the anchors you are expecting, you might be able to combine them into a single rex

| rex "(anchor1|anchor2|anchor3)(?<card>\d{16})\D"

Kk
Path Finder

Yeah we can do in that way but in anchor tag we can't expect only card details. We have some other data too.

Example:

card>xxxxxxxxxx9787<card

card> this is so and so info xxxxxxxx9797<card.

So how can we search card details in these cases.

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

https://regex101.com/r/eqLFaV/1 

| rex "card>.*?\D?(?<card>\d{16})\<card"

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...