Getting Data In

Scrub command failing

responsys_cm
Builder

I'm trying to send a vendor some of our log data and I need to scrub the accountname and username fields in the data, but leave everything else untouched.

I edited the /opt/splunk/etc/anonymizer/private-terms.txt to include all of the accountnames and usernames that need to be anonymized. I pipe my search to scrub as follows:

| scrub private-terms=private-terms.txt

The search completes with the following error and no data: The external search command 'scrub' did not return events in descending time order, as expected.

I also tried the method described here:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/AnonymizedatasamplestosendtoSuppo...

But that approach scrubbed all of the data, including timestamps and seemed to ignore all of the entries I put in the public-terms.txt.

What is the easiest way to anonymize a couple of fields that have dozens of unique values in each? I know I can do it with the replace command, but that will take forever...

Thx.

Craig

Tags (1)
0 Karma

Masa
Splunk Employee
Splunk Employee

Please add "overrides_timeorder = true" in commands.conf


- etc/apps/search/local/commands.conf
[scrub]
overrides_timeorder = true

Restarting Splunk is not required for this change.

<your search> | scrub private-terms=

0 Karma

Masa
Splunk Employee
Splunk Employee

We'll ask our doc team to add this information

0 Karma

BenjaminWyatt
Communicator

Bump. I am getting the same error and would like to know if anyone has found a resolution to this problem.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...