While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X? | makeresults | eval…

The correct answer is A. sed. In Splunk, the rex command supports a mode=sed parameter that activates sed-style substitution syntax, which is exactly what the s/pattern/replacement/flags expression in the question represents. Without mode=sed, rex only performs field extraction using named capture groups…

Security Data Onboarding and Normalization

Question

While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X? | makeresults | eval ccnumber="511388720478619733" | rex field=ccnumber mode=??? "s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g" Please assume that the above rex command is correctly written.

Options

Ased
Breplace
Cmask
Dsubstitute

How the community answered

(41 responses)

A
71% (29)
B
17% (7)
C
7% (3)
D
5% (2)

Explanation

In Splunk, the rex command supports a mode=sed parameter that activates sed-style substitution syntax, which is exactly what the s/pattern/replacement/flags expression in the question represents. Without mode=sed, rex only performs field extraction using named capture groups - it cannot replace or mask values. Options B (replace), C (mask), and D (substitute) are all plausible-sounding distractors, but none are valid values for the rex command's mode parameter in Splunk; only sed is a recognized mode that enables substitution behavior.

Memory tip: Look at the regex itself - it starts with s/, which is the classic sed substitution command. The s is a dead giveaway: mode=sed unlocks s/find/replace/ syntax. If you see s/ in a rex command, the mode must be sed.

Topics

#rex command#sed mode#data masking#PII redaction

Community Discussion

No community discussion yet for this question.

Full SPLK-5001 Practice