Getting Data In

Delete PII from Splunk


We're using Splunk for logging from multiple applications. Some of these applications deal with PII data.

If one of those applications puts the PII data in Splunk, how can it be removed or deleted?

I need to remove the data from the machine and Splunk.

0 Karma

Splunk Employee
Splunk Employee


there are some options... but remember Splunk is more like an event recorder.

Since most of the fields are extracted at search time, we can't identify PII data at ingestion time.

Easiest thing is to scrub the data at ingestion time... props/transforms.conf -> anonymize the data

The "delete" command does not really delete, it marks "as deleted".

You can set the retention time in the index accordingly... data will be removed completely.

If you need to remove a specific event, you might dump the index via a search, remove the index and then re-index it... not nice but an option.

Again, Splunk is not an RDBMS where you just delete a row.



.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!