Delete PII from Splunk

[ryan_gates]

We're using Splunk for logging from multiple applications. Some of these applications deal with PII data.

If one of those applications puts the PII data in Splunk, how can it be removed or deleted?

I need to remove the data from the machine and Splunk.

[hsesterhenn_spl]

Hi,

there are some options... but remember Splunk is more like an event recorder.

Since most of the fields are extracted at search time, we can't identify PII data at ingestion time.

Easiest thing is to scrub the data at ingestion time... props/transforms.conf -> anonymize the data

The "delete" command does not really delete, it marks "as deleted".

You can set the retention time in the index accordingly... data will be removed completely.

If you need to remove a specific event, you might dump the index via a search, remove the index and then re-index it... not nice but an option.

Again, Splunk is not an RDBMS where you just delete a row.

HTH,

Holger