topic How can I enrypt of hash a field before index? in Deployment Architecture

How can I enrypt of hash a field before index?

daniel333 — Sat, 21 Oct 2017 04:41:42 GMT

Good morning,

I have a log file, that I am told by security the email addresses need to be hashed. Any idea how I do this?

Re: How can I enrypt of hash a field before index?

Damien_Dallimor — Sat, 21 Oct 2017 04:54:06 GMT

If you want to hash a field or encrypt a field or encrypt a hash of a field (it's not clear from your post title and body) , then you can't do this natively with Splunk.You'll need an App/Add-On/Custom code etc... to perform some sort of pre-processing for you.

Depending on how you are indexing your data , you can get some ideas from this blog post : www.baboonbones.com/blog/get-binary-data-splunk/ , in particular the "Data Obfuscation in Splunk Enterprise" link.

Re: How can I enrypt of hash a field before index?

gcusello — Sat, 21 Oct 2017 08:45:56 GMT

Hi daniel333,
as @Damien Dallimore said there isn't any way to do yhis in Splunk.
For one our customer, by suggest of Splunk Professional services, we encrypted a field in a log pre-processing it with an external PHP script that was using a certificate to have a reversible encrypting.
In this way we're able to decrypt the field and know the real value of this field (an account name in proxy navigating).
The procedure is that:

we receive syslogs from proxies in a syslog server,
we write them in a file,
we parse the file encrypting the account field,
we ingest it in Splunk.

Bye.
Giuseppe