Can you obfuscate data in journal.gz after deleting the events?

[cpetterborg]

Let's say I have an index that contains events with cleartext passwords. I can delete those events and they are no longer searchable in the UI, but the raw data still exists in the journal.gz file. Is it possible to modify that journal.gz file so that it will still be searchable, but the password is obfuscated? For example the original:

... thing1=thisismypassword ...

becomes:

... thing1=XXXXXXXXXXXXXXXX ...

having the same number of characters, just not the actual password.

I'm not sure how the Splunk indexing relies on the data being exactly as it was created in the journal.gz file.

[woodcock · Accepted solution]

This is how you do it:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

[cpetterborg]

That works for data that is not yet indexed, but not for data that has already been indexed and sitting out there in the journal.gz file.

The unfortunate thing about developers is that they do stupid things (that any amount of precaution on your part to prevent secure data from going into an index) won't prevent.

[woodcock]

Indexed data is immutable by design (and by necessity for certain applications, e.g. Compliance). All you can do is purge it and reindex it.

[cpetterborg]

This is the answer that I'm accepting. I should have done this long ago, but I wasn't sure how to best accept it. So for those of you reading this answer, know that woodcock is right. The data can't be changed. If you do change it, it can break your data.