Hi,
i have personal data stored in Splunk like a first/last name, example FN=JOHN LN=PUBLIC .
Due to common data protection laws i'm getting asked to delete those records after a period of time.
Since i don't want to delete the entire record i'm wondering if it is possible to modify those values afterwards to say FN=XXXXX LN=YYYYYY .
Is this somehow possible?
It's not possible, but you could censor the records into another index using the search command collect before deleting them.
It's not possible, but you could censor the records into another index using the search command collect before deleting them.