Getting Data In

Redact syslog using Splunk?

zerolife
Explorer

What we are trying to do is pipe DLP incident data to Splunk using syslog. However the challenge is that we need to redact certain data fields from the DLP syslog output (can't limit this on DLP's side). So I was wondering if it's possible to have another Splunk instance sit between the DLP and the existing indexing Splunk infrastructure, and which will redact/mask specific data from the syslog before forwarding it to the indexing Splunk. If not, is there any other way to archive this?

Thank you for any help

Tags (2)
0 Karma
1 Solution

jgedeon120
Contributor

Yes you can do this. If you are collecting using a heavy forwarder to either read the log files you can do it there or with an intermediate forwarder. It needs to be the first Splunk Enterprise system that cooks the data.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Anonymizedatausingconfigurationfiles

View solution in original post

jgedeon120
Contributor

Yes you can do this. If you are collecting using a heavy forwarder to either read the log files you can do it there or with an intermediate forwarder. It needs to be the first Splunk Enterprise system that cooks the data.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Anonymizedatausingconfigurationfiles

zerolife
Explorer

thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...