topic Re: Scrub command failing in Getting Data In

Scrub command failing

responsys_cm — Tue, 13 Nov 2012 19:58:40 GMT

I'm trying to send a vendor some of our log data and I need to scrub the accountname and username fields in the data, but leave everything else untouched.

I edited the /opt/splunk/etc/anonymizer/private-terms.txt to include all of the accountnames and usernames that need to be anonymized. I pipe my search to scrub as follows:

| scrub private-terms=private-terms.txt

The search completes with the following error and no data: The external search command 'scrub' did not return events in descending time order, as expected.

I also tried the method described here:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/AnonymizedatasamplestosendtoSupport

But that approach scrubbed all of the data, including timestamps and seemed to ignore all of the entries I put in the public-terms.txt.

What is the easiest way to anonymize a couple of fields that have dozens of unique values in each? I know I can do it with the replace command, but that will take forever...

Thx.

Craig

Re: Scrub command failing

BenjaminWyatt — Wed, 15 May 2013 14:29:26 GMT

Bump. I am getting the same error and would like to know if anyone has found a resolution to this problem.

Re: Scrub command failing

Masa — Mon, 28 Sep 2020 14:38:21 GMT

Please add "overrides_timeorder = true" in commands.conf



- etc/apps/search/local/commands.conf 

[scrub] 

overrides_timeorder = true

Restarting Splunk is not required for this change.



<your search> | scrub private-terms=

Re: Scrub command failing

Masa — Fri, 23 Aug 2013 16:59:24 GMT

We'll ask our doc team to add this information