iscc

You can use iscc when analyzing logs that may contain sensitive data to detect accidental leakage of credit card information. It’s also useful when filtering or sanitizing input data, monitoring suspicious behavior, or validating form submissions in telemetry data.

Usage#

Syntax#

iscc(value)

Parameters#

Name	Type	Description
value	string	The string to evaluate for validity.

Returns#

A bool value:

true if the input string is a valid credit card number.
false otherwise.

Example#

Query

['sample-http-logs']
| extend has_credit_card = iscc('4111111111111111')
| project _time, has_credit_card

Run in Playground

Output

_time	has_credit_card
2025-07-10T10:42:00	true

isimei: Checks whether a value is a valid International Mobile Equipment Identity (IMEI) number.
isreal: Checks whether a value is a real number.
isstring: Checks whether a value is a string. Use this for scalar string validation.
isutf8: Checks whether a value is a valid UTF-8 encoded sequence.

Other query languages#

Splunk SPL users

Splunk SPL doesn’t provide a built-in function for validating credit card numbers. To perform similar validation, you typically rely on regular expressions and manual checksum implementations using eval or custom search commands.

Splunk example

... | eval is_cc=if(match(field, "^[0-9]{13,19}$") AND luhn_check(field), "true", "false")

APL equivalent

datatable(card:string)
[
  '4111111111111111',
  '1234567890123456'
]
| extend is_cc = iscc(card)

ANSI SQL users

ANSI SQL does not define a standard function for credit card validation. You must use a combination of pattern matching with LIKE or REGEXP, plus a user-defined function to implement checksum validation.

SQL example

SELECT card,
       CASE WHEN is_valid_card(card) THEN 'true' ELSE 'false' END AS is_cc
FROM transactions