Redact syslog using Splunk?

[zerolife]

What we are trying to do is pipe DLP incident data to Splunk using syslog. However the challenge is that we need to redact certain data fields from the DLP syslog output (can't limit this on DLP's side). So I was wondering if it's possible to have another Splunk instance sit between the DLP and the existing indexing Splunk infrastructure, and which will redact/mask specific data from the syslog before forwarding it to the indexing Splunk. If not, is there any other way to archive this?

Thank you for any help

[jgedeon120 · Accepted solution]

Yes you can do this. If you are collecting using a heavy forwarder to either read the log files you can do it there or with an intermediate forwarder. It needs to be the first Splunk Enterprise system that cooks the data.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Anonymizedatausingconfigurationfiles

[zerolife]

thanks for your help!