Getting Data In

TCP Routing and Anonymizing data

SirHill17
Communicator

Hi,

I am trying to anonymize data at the forwarder level (or deployment-server) before forwarding the data to the indexer. The aim of that is to keep the control on the masking because the indexer is not managed by the same team within the company. So we would like to control the data masking.

I tried to configure props.conf and transforms.conf on the deployment server and on the universal forwarder but it doesn't work. Do you have any idea ? My second option would be to have a copy (more or less in real time) from my indexer (which will anonymize the data) and have the logs sent to the second indexer (the one not managed by myself).

Thanks for your help.

SirHill

0 Karma
1 Solution

jmallorquin
Builder

Hi,

You can use a HeavyForwader to send the coocked data to the indexer. In the heavy forwarder you can anonymize the info.

Hope i help you.

View solution in original post

kristian_kolb
Ultra Champion

jmallorquin is right mentioning Heavy Forwarders, that is the only way you can control masking before getting data processed by an indexer (beyond your control). The reason is that the universal forwarder does not read/understand those parts of the configuration in props/transforms, so they are basically ignored by the UF.

The deployment server in itself has nothing to do with this, and any app you deploy to a UF through the DS with such configs will do nothing - for the reasons mentioned above.

So you should either install a HF (with configs for masking data) and direct your UF's to send to the HF - and of course set the HF to send to your indexer(s). Or you install a HF on each source system instead of a UF, and then you can deploy a masking app via DS.

/k

jmallorquin
Builder

Hi,

You can use a HeavyForwader to send the coocked data to the indexer. In the heavy forwarder you can anonymize the info.

Hope i help you.

SirHill17
Communicator

Thanks for that, I read the doc and it's what I was looking for.

Just a question about it, is it possible to forward only some defined indexes or it will duplicate every index ? I am asking that checking at the message in the config:

Data will be auto load balanced to each host:port

Thanks!

0 Karma

kristian_kolb
Ultra Champion
0 Karma

SirHill17
Communicator

Great, thanks

0 Karma

jmallorquin
Builder

Ofcourse,

You can use props.conf and transforms.conf to routing the events that you want.

Hope i help you.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...