Mask/Encrypt Specific field from universal forwarder agent side

[Amirahussein]

Hi everybody,

I need your assistance if you have encountered this problem or not since I want to mask a particular field before it is processed by SPLUNK indexers.
I need to mask a particular field because the data will be transferred via a universal forwarder (an externally installed agent).

Regards, Amira

[gcusello]

Hi @Amirahussein,

you can find the solution to your request in my previous answer https://community.splunk.com/t5/Getting-Data-In/Could-someone-help-me-with-Data-Masking/m-p/613560#M... 

and you can find the Splunk documentation at https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata 

Ciao.

Giuseppe