Splunk Search

splunk query help ?

splunker969
Communicator

How to write search query to find from particular host is sending any credit card data into splunk by using regex ?
Discover card

dinerclub
mastercard
visa

index=* host =X|regex="(4[0-9]{14})|(5[1-5][0-9]{14})

Please help me in query

Tags (1)
0 Karma

somesoni2
Revered Legend

You can use the regex used in below link. https://wiki.splunk.com/Community:Credit_card_masking_regex
The filtering query can be like this

index=* host =X|regex _raw=">+REGEXfromABOVElink"

OR

index=* host =X|where match(_raw,"REGEXfromABOVElink")

splunker969
Communicator

Thanks Somesoni2

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...