Delete PII from Splunk

ryan_gates — Tue, 27 Mar 2018 18:07:01 GMT

We're using Splunk for logging from multiple applications. Some of these applications deal with PII data.

If one of those applications puts the PII data in Splunk, how can it be removed or deleted?

I need to remove the data from the machine and Splunk.

Re: Delete PII from Splunk

hsesterhenn_spl — Tue, 27 Mar 2018 18:59:41 GMT

Hi,

there are some options... but remember Splunk is more like an event recorder.

Since most of the fields are extracted at search time, we can't identify PII data at ingestion time.

Easiest thing is to scrub the data at ingestion time... props/transforms.conf -> anonymize the data

The "delete" command does not really delete, it marks "as deleted".

You can set the retention time in the index accordingly... data will be removed completely.

If you need to remove a specific event, you might dump the index via a search, remove the index and then re-index it... not nice but an option.

Again, Splunk is not an RDBMS where you just delete a row.

HTH,

Holger