Let's say I have an index that contains events with cleartext passwords. I can delete those events and they are no longer searchable in the UI, but the raw data still exists in the journal.gz file. Is it possible to modify that journal.gz file so that it will still be searchable, but the password is obfuscated? For example the original:
... thing1=thisismypassword ...
... thing1=XXXXXXXXXXXXXXXX ...
having the same number of characters, just not the actual password.
I'm not sure how the Splunk indexing relies on the data being exactly as it was created in the journal.gz file.
That works for data that is not yet indexed, but not for data that has already been indexed and sitting out there in the journal.gz file.
The unfortunate thing about developers is that they do stupid things (that any amount of precaution on your part to prevent secure data from going into an index) won't prevent.
This is the answer that I'm accepting. I should have done this long ago, but I wasn't sure how to best accept it. So for those of you reading this answer, know that woodcock is right. The data can't be changed. If you do change it, it can break your data.