Getting Data In

Delete PII from Splunk

ryan_gates
Explorer

We're using Splunk for logging from multiple applications. Some of these applications deal with PII data.

If one of those applications puts the PII data in Splunk, how can it be removed or deleted?

I need to remove the data from the machine and Splunk.

0 Karma

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

there are some options... but remember Splunk is more like an event recorder.

Since most of the fields are extracted at search time, we can't identify PII data at ingestion time.

Easiest thing is to scrub the data at ingestion time... props/transforms.conf -> anonymize the data

The "delete" command does not really delete, it marks "as deleted".

You can set the retention time in the index accordingly... data will be removed completely.

If you need to remove a specific event, you might dump the index via a search, remove the index and then re-index it... not nice but an option.

Again, Splunk is not an RDBMS where you just delete a row.

HTH,

Holger

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...