Re: Anonymize Indexed data

fnlfaraz · ‎11-17-2020

Hi,

I have some data in my Splunk indexer (historical data) and I want to anonymize it now. Is there any better way to SCRUB it instead of deleting the data?

I'm using SE v7.1.7

richgalloway · ‎11-18-2020

Once data is indexed it cannot be changed in any way. Anonymization must occur before or during the indexing process.

---
If this reply helps you, Karma would be appreciated.

Anonymize Indexed data

indexer

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

Splunk APM: New Product Features + Community Office Hours Recap!

Index This | Forward, I’m heavy; backward, I’m not. What am I?