Partial obfuscation in Splunk Cloud

Flobzh — Wed, 16 Jun 2021 14:33:32 GMT

Hello experts,

I'm trying to obfuscate the UserName and ComputerName from my events before indexation, while keeping the possibility of using the data to group from a common source.

Configuration: data are pushed by a UniversalForwarder (no transform options) to a SplunkCloud instance (limited setup).

Example:

I have this:

And want something like this:

Where GeneratedSessionID=function(user1,FR1234,encryptKey) or something similar. Meaning that the same couple computer+user will always create the same GeneratedSessionID

I'm looking at adding a SECCMD setting on the Advanced tab of my SourceType. I see how to anonymize the UserName and ComputerName, but not how to add a new field based on the others.

Flobzh_0-1623853581312.png

Any advise in that direction would be welcome, or any solution that will match with the restriction of my configuration.

Thanks in advance

Florent

topic Partial obfuscation in Splunk Cloud in Getting Data In

Partial obfuscation in Splunk Cloud