topic Re: Password hashing in Splunk in Security

Password hashing in Splunk

anandhalagaras1 — Wed, 18 Mar 2020 14:42:29 GMT

In one of the file the password seems to be present and the same has been getting ingested into Splunk. So is there any way to hash the password for that field so that it wont be visible in Splunk during searching eventhough it is present in the logs.

Re: Password hashing in Splunk

PavelP — Wed, 18 Mar 2020 15:18:32 GMT

I don't think it is possible, but I can suggest a workaround:
You can mask passwords with SEDCMD command during the ingestion and send it to one index and send unmodified events into other index, which can be accessed by you only.

Let me know if it solves your question. If not - try to describe your use case so may be somebody can give your better solution.

Re: Password hashing in Splunk

woodcock — Wed, 18 Mar 2020 15:26:50 GMT

Moving forward, you can use SEDCMD to strip it:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
or INGEST_EVAL to hash it (I would not bother):
https://splunkonbigdata.com/2019/03/22/ingest_eval/
Moving backward, you will have to reprocess it from original raw events OR use collect to re-index from existing events (then go back and delete the old evetns):
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect