Getting Data In

Masking multiple credit card number for a specific field using SEDCMD

anupt1986
New Member

Hi,

Have an event where i would like to mask credit card number only within below two fields using SEDCMD only.

i.e. "PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationDetections.DetectedValues{}.Name

and

"PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationDetections.DetectedValues{}.Value"

If i just use

| rex mode=sed "s/(\d{4}){3}(\d{4})/xxxx-xxxx-xxxx-\2/g

this will check for match in whole event and mask values which it should not mask 😞

so am testing with below snippet code something like this :

| gentimes start=-1
| eval myevent="PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationDetections.DetectedValues{}.Name:[\"6011111111111117\",\"6011000990139424\",\"4111111111111111\",\"5555555555554444\",\"5105105105105100\",\"38520000023237\"]"
| table myevent
| rename myevent as new
| eval old=new
| rex mode=sed "s/(,.*DetectedValues{}.*\:\[\")(\d{4}){3}(\d{4})/xxxx-xxxx-xxxx-\2/g"

 

expected outcome: like this for one of field but should do similar for other field as well.

"PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationDetections.DetectedValues{}.Name":["xxxxxxxxxxxx1117","xxxxxxxxxxxx9424","xxxxxxxxxxxx1111","xxxxxxxxxxxxx4444","5xxxxxxxxxxxx5100","xxxxxxxxxxxx3237"]

 

 

 

Labels (1)
0 Karma

danielcj
Communicator

Hi, 
You can define the field which your rex command will be applied using the "field" command.
For your example, try replacing your last line for the following:

 

| rex mode=sed field=new "s/(\d{4}){3}(\d{4})/xxxx-xxxx-xxxx-\2/g"

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...