Getting Data In
Highlighted

How to anonymize data after indexation

Engager

Hi !
I know how to anonymize data before adding them to an index (using sed & props.conf).
But how to apply this sed to the data already in an index ?

Thanks.

Tags (3)
Highlighted

Re: How to anonymize data after indexation

SplunkTrust
SplunkTrust

You can't. Sorry. What has been stored in the index is there, and there isn't a supported way to change it.

0 Karma
Highlighted

Re: How to anonymize data after indexation

Legend

What you COULD do is to anonymize the search results instead using the scrub command, but as dwaddle says there's no changing the actual stored data once it's been indexed.

Highlighted

Re: How to anonymize data after indexation

Motivator

and adding to Ayn about using the scrub command in a summary indexing search and only give access to this summary index to those not allowed to see raw data