Getting Data In

TCP Routing and Anonymizing data

SirHill17
Communicator

Hi,

I am trying to anonymize data at the forwarder level (or deployment-server) before forwarding the data to the indexer. The aim of that is to keep the control on the masking because the indexer is not managed by the same team within the company. So we would like to control the data masking.

I tried to configure props.conf and transforms.conf on the deployment server and on the universal forwarder but it doesn't work. Do you have any idea ? My second option would be to have a copy (more or less in real time) from my indexer (which will anonymize the data) and have the logs sent to the second indexer (the one not managed by myself).

Thanks for your help.

SirHill

0 Karma
1 Solution

jmallorquin
Builder

Hi,

You can use a HeavyForwader to send the coocked data to the indexer. In the heavy forwarder you can anonymize the info.

Hope i help you.

View solution in original post

kristian_kolb
Ultra Champion

jmallorquin is right mentioning Heavy Forwarders, that is the only way you can control masking before getting data processed by an indexer (beyond your control). The reason is that the universal forwarder does not read/understand those parts of the configuration in props/transforms, so they are basically ignored by the UF.

The deployment server in itself has nothing to do with this, and any app you deploy to a UF through the DS with such configs will do nothing - for the reasons mentioned above.

So you should either install a HF (with configs for masking data) and direct your UF's to send to the HF - and of course set the HF to send to your indexer(s). Or you install a HF on each source system instead of a UF, and then you can deploy a masking app via DS.

/k

jmallorquin
Builder

Hi,

You can use a HeavyForwader to send the coocked data to the indexer. In the heavy forwarder you can anonymize the info.

Hope i help you.

SirHill17
Communicator

Thanks for that, I read the doc and it's what I was looking for.

Just a question about it, is it possible to forward only some defined indexes or it will duplicate every index ? I am asking that checking at the message in the config:

Data will be auto load balanced to each host:port

Thanks!

0 Karma

kristian_kolb
Ultra Champion
0 Karma

SirHill17
Communicator

Great, thanks

0 Karma

jmallorquin
Builder

Ofcourse,

You can use props.conf and transforms.conf to routing the events that you want.

Hope i help you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...