Splunk Dev

How do you redact data that's already indexed?

lostbeatnik01
Explorer

We currently index logs into index=indexY at a rate of 2G – 5G a day with the retention set to 12 months.

One day last week, a code update started logging the user and password into the log in the form of ‘password=changeme’. Our Splunk environment is certified non-pci/non-private data and needs to remain so. We need to retain the event data due to security best practices, it is the event for access to a critical services, however the field needs to be redacted.

What are the best options for retaining the data while scrubbing the field? For instance 'password=change' should be redacted to 'password=SCRUBBED' or removed entirely. Please consider that that data at rest cannot contain confidential data, so masking it at the Search Head is not a viable solution.

Tags (1)

harsmarvania57
SplunkTrust
SplunkTrust

Hi @lostbeatnik01,

You can't alter indexed data so only option is to remove those data, you can use | delete command which hides data from searching but it will not remove data from server and to use this command you need can_delete capability in role, even admin role does not have this capability by default.

To anonymize any new data you can use SEDCMD- or combination of props and transforms, have a look at document https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Anonymizedata

dkeck
Influencer

HI

there is a new function called ingest_eval. This lets you mask data at index time. I think its included since 7.2

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/IngestEval

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...