Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: PII In Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I wonder whether someone could help me please.
Firstly forgive me for what may a stupid question.
But could someone tell me, is it possible to remove all PII from Splunk Enterprise even if you don't know all the field names containing it. I suspect this would have to be done at indexing?
Many thanks and kind regards
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In general of course it is impossible to remove things you don't know about. And yes, to remove it properly it would have to be done at indextime, for instance using SEDCMD in props.conf.
If you don't know the exact fields or position in the logs, but you do know the kind of patters you want to mask/remove (e.g. social security numbers / credit card numbers / ip addresses / email addresses), you can use SEDCMD to mask anything matching those patterns.
This page in the docs describes it in more detail: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In general of course it is impossible to remove things you don't know about. And yes, to remove it properly it would have to be done at indextime, for instance using SEDCMD in props.conf.
If you don't know the exact fields or position in the logs, but you do know the kind of patters you want to mask/remove (e.g. social security numbers / credit card numbers / ip addresses / email addresses), you can use SEDCMD to mask anything matching those patterns.
This page in the docs describes it in more detail: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @FrankVl.
Thank you for taking the time to reply to my message and for the confirmation.
Kind Regards
Chris
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
Data Management Digest – May 2026
