Getting Data In

Scrub command failing

responsys_cm
Builder

I'm trying to send a vendor some of our log data and I need to scrub the accountname and username fields in the data, but leave everything else untouched.

I edited the /opt/splunk/etc/anonymizer/private-terms.txt to include all of the accountnames and usernames that need to be anonymized. I pipe my search to scrub as follows:

| scrub private-terms=private-terms.txt

The search completes with the following error and no data: The external search command 'scrub' did not return events in descending time order, as expected.

I also tried the method described here:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/AnonymizedatasamplestosendtoSuppo...

But that approach scrubbed all of the data, including timestamps and seemed to ignore all of the entries I put in the public-terms.txt.

What is the easiest way to anonymize a couple of fields that have dozens of unique values in each? I know I can do it with the replace command, but that will take forever...

Thx.

Craig

Tags (1)
0 Karma

Masa
Splunk Employee
Splunk Employee

Please add "overrides_timeorder = true" in commands.conf


- etc/apps/search/local/commands.conf
[scrub]
overrides_timeorder = true

Restarting Splunk is not required for this change.

<your search> | scrub private-terms=

0 Karma

Masa
Splunk Employee
Splunk Employee

We'll ask our doc team to add this information

0 Karma

BenjaminWyatt
Communicator

Bump. I am getting the same error and would like to know if anyone has found a resolution to this problem.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...