topic Redact syslog using Splunk? in Getting Data In

Redact syslog using Splunk?

zerolife — Wed, 09 Apr 2014 20:54:41 GMT

What we are trying to do is pipe DLP incident data to Splunk using syslog. However the challenge is that we need to redact certain data fields from the DLP syslog output (can't limit this on DLP's side). So I was wondering if it's possible to have another Splunk instance sit between the DLP and the existing indexing Splunk infrastructure, and which will redact/mask specific data from the syslog before forwarding it to the indexing Splunk. If not, is there any other way to archive this?

Thank you for any help

Re: Redact syslog using Splunk?

jgedeon120 — Wed, 09 Apr 2014 21:50:26 GMT

Yes you can do this. If you are collecting using a heavy forwarder to either read the log files you can do it there or with an intermediate forwarder. It needs to be the first Splunk Enterprise system that cooks the data.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Anonymizedatausingconfigurationfiles

Re: Redact syslog using Splunk?

zerolife — Fri, 11 Apr 2014 18:42:52 GMT

thanks for your help!