Anonymize Indexed data

[fnlfaraz]

Hi,

I have some data in my Splunk indexer (historical data) and I want to anonymize it now. Is there any better way to SCRUB it instead of deleting the data?

I'm using  SE v7.1.7

[richgalloway]

Once data is indexed it cannot be changed in any way.  Anonymization must occur before or during the indexing process.