Getting Data In

How do I keep my IP address data un anonymized by using splunk anonimizer?

melonman
Motivator

Hi

I am using splunk CLI anonymize command to anonymize my log data.
One thing I would like to do with the command is to keep my IP address data NOT anonymized.
Can I do such thing using anonymize CLI commant?

Any comment would be appreciated.
Thank you in advance,

Tags (1)
0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

I'm not sure if this will do exactly what you want, but you can add terms to the $SPLUNK_HOME/etc/anonymizer/dictionary.txt file that you don't want anonymized (see here for more info). In your case, since you want to keep IP's intact, you'd need to add 1, 2, 3, ... 255 to this file.

for i in `seq 1 10` ; do echo $i >> $SPLUNK_HOME/etc/anonymizer/dictionary.txt ; done

I say this might not do what you want because there may be other numbers that you do want anonymized, however this change might prevent that. YMMV.

View solution in original post

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

I'm not sure if this will do exactly what you want, but you can add terms to the $SPLUNK_HOME/etc/anonymizer/dictionary.txt file that you don't want anonymized (see here for more info). In your case, since you want to keep IP's intact, you'd need to add 1, 2, 3, ... 255 to this file.

for i in `seq 1 10` ; do echo $i >> $SPLUNK_HOME/etc/anonymizer/dictionary.txt ; done

I say this might not do what you want because there may be other numbers that you do want anonymized, however this change might prevent that. YMMV.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...