Security

Mask Splunk access logs

BryanBerry
Path Finder

I'm wondering if it's possible to mask/scrub the Splunk access logs. If so, how?

It's for a security requirement. We have a search page that does a one-way hash of an input value and searches for the hash, but we don't want any written record of the input value. This value would appear in the Splunk access logs for a given request.

Edit:
I would like to do this for the Splunk access logs on the filesystem.

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

It is likely not possible to mask these directly in the Splunk access logs before they are written to flat files on disk. It may be possible with some deep hacking into Splunkweb and/or new framework (written in python) - but if it is showing up in the splunkd_access.log, then that's compiled C++ code that you cannot even change.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

It is likely not possible to mask these directly in the Splunk access logs before they are written to flat files on disk. It may be possible with some deep hacking into Splunkweb and/or new framework (written in python) - but if it is showing up in the splunkd_access.log, then that's compiled C++ code that you cannot even change.

0 Karma

BryanBerry
Path Finder

Not the answer I was hoping for, but an effective answer. Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, yes you can. You will need to make a transforms for the splunkd_access logs. Ref: http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Transformsconf

props.conf
[splunkd_access]
TRANSFORMS-splunkdhash = splunkd-masker

transforms.conf
[splunkd-masker]
REGEX = (?m)^(.*)fieldofhash=YOUR_REGEX_FOR_HASH(.*)$
FORMAT = $1=anonyhash$2
DEST_KEY = _raw

alacercogitatus
SplunkTrust
SplunkTrust

Then no. Splunkd writes those out. You could cron a script to replace in the file, but then Splunk re-indexes it.

0 Karma

BryanBerry
Path Finder

Sorry, I wasn't clear. I mean to mask Splunk's access logs on the filesystem itself.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...