Getting Data In

Can you obfuscate data in journal.gz after deleting the events?

cpetterborg
SplunkTrust
SplunkTrust

Let's say I have an index that contains events with cleartext passwords. I can delete those events and they are no longer searchable in the UI, but the raw data still exists in the journal.gz file. Is it possible to modify that journal.gz file so that it will still be searchable, but the password is obfuscated? For example the original:

... thing1=thisismypassword ...

becomes:

... thing1=XXXXXXXXXXXXXXXX ...

having the same number of characters, just not the actual password.

I'm not sure how the Splunk indexing relies on the data being exactly as it was created in the journal.gz file.

0 Karma
1 Solution

woodcock
Esteemed Legend
0 Karma

woodcock
Esteemed Legend
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

That works for data that is not yet indexed, but not for data that has already been indexed and sitting out there in the journal.gz file.

The unfortunate thing about developers is that they do stupid things (that any amount of precaution on your part to prevent secure data from going into an index) won't prevent.

0 Karma

woodcock
Esteemed Legend

Indexed data is immutable by design (and by necessity for certain applications, e.g. Compliance). All you can do is purge it and reindex it.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

This is the answer that I'm accepting. I should have done this long ago, but I wasn't sure how to best accept it. So for those of you reading this answer, know that woodcock is right. The data can't be changed. If you do change it, it can break your data.

0 Karma