topic Re: Encrypt the Source data in Splunk Search

Encrypt the Source data

vijreddy30 — Wed, 08 Nov 2023 16:17:08 GMT

Hi All,

My requirement is source data records data need to be encrypted. What does process need to follow? Is there any possibly props.conf ?

Please help me the process.

Regards,

Vij

Re: Encrypt the Source data

gcusello — Thu, 09 Nov 2023 07:20:58 GMT

Hi @vijreddy30,

what do you meam with encrypt source data?

are you speaking of encrypt the original files? it isn't a Splunk Matter,

are you speaking of data transmission, which kind of ingestions are you speaking about: forwarders, syslog, HEC?

if Forwarders, you can excrypt data between Forwarders and Indexers and there are checking technics inside Splunk.

If you're speaking of syslog: I hint to use an rsyslog server and read files using a Universal Forwarders; I'm not sure that's possible to encrypt syslogs; in addition, you could use two UFs and a Load Balancer to avoid Single Point of Failures,

If you're speaking of HEC, you can use https and the token is a securization of your ingestion; as syslogs, you should use two Forwarders and a Load Balancer.

if you're speaking of encryption on Splunk see at https://www.splunk.com/en_us/blog/learn/end-to-end-encryption.html?locale=en_us

Ciao.

Giuseppe

Re: Encrypt the Source data

vijreddy30 — Thu, 09 Nov 2023 10:41:27 GMT

2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - Header Field Name: MOM_Caution_e_1, value is out of Bounds using beginIndex:608, endIndex:684 from line:
2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.Kpr.batchrecordprint.scheduledTasks - 02000011831199QD06620

my requirement is encrypt the WARN pool-1-........................ record the source file

please help me the process

Re: Encrypt the Source data

gcusello — Thu, 09 Nov 2023 11:23:47 GMT

Hi @vijreddy30,

let me understand: do you want to mask some events or part of event in permanent way or in reversible way?

if in reversible way, you have to preprocess your data using a script and a certificate and then index your data using Splunk.

If you only want to anonymize a part of your data, follow the instructions at https://www.splunk.com/en_us/blog/learn/data-anonymization.html or https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata?_gl=1*b5bay4*_ga*MTY1NjIzMDM3OC4xNjk3MjA1MzU0*_ga_GS7YF8S63Y*MTY5OTUyODU5My41MjcuMS4xNjk5NTI4ODA3LjI3LjAuMA..*_ga_5EPM2P39FV*MTY5OTUyODU2NC42NDAuMS4xNjk5NTI4OTg0LjAuMC4w&_ga=2.165103034.468842275.1697205354-1656230378.1697205354&_gac=1.117944699.1697439287.Cj0KCQjwm66pBhDQARIsALIR2zDDpMo42f4nQY5ylRFnUfEyW_h0bbBBKVDgM2rBU1cuYdYxGqfUTWkaAjkxEALw_wcB#Anonymize_data_through_a_sed_script

Ciao.

Giuseppe