Exam SPLK-5001 topic 1 question 59 discussion

A https://docs.splunk.com/Documentation/SCS/current/SearchReference/RexCommandExamples

A. sed is correct. In Splunk, setting mode=sed with the rex command allows the use of sed-style substitution to replace matched patterns with specified values, such as replacing parts of a credit card number with "X". The sed mode is specifically designed for search-time string replacements and masking sensitive data. So, the correct syntax would be: | makeresults | eval ccnumber="511388720478619733" | rex field=ccnumber mode=sed "s/(\d{4}-){3}/XXXX-XXXX-XXXX-/g"

To replace defined values with "X" using the rex command in Splunk, you should set the mode to C. mask. Using the mask mode will ensure that the credit card number is masked as intended.

Someone please verify the accuracy of this answer