TCP Routing and Anonymizing data

[SirHill17]

Hi,

I am trying to anonymize data at the forwarder level (or deployment-server) before forwarding the data to the indexer. The aim of that is to keep the control on the masking because the indexer is not managed by the same team within the company. So we would like to control the data masking.

I tried to configure props.conf and transforms.conf on the deployment server and on the universal forwarder but it doesn't work. Do you have any idea ? My second option would be to have a copy (more or less in real time) from my indexer (which will anonymize the data) and have the logs sent to the second indexer (the one not managed by myself).

Thanks for your help.

SirHill

[kristian_kolb]

jmallorquin is right mentioning Heavy Forwarders, that is the only way you can control masking before getting data processed by an indexer (beyond your control). The reason is that the universal forwarder does not read/understand those parts of the configuration in props/transforms, so they are basically ignored by the UF.

The deployment server in itself has nothing to do with this, and any app you deploy to a UF through the DS with such configs will do nothing - for the reasons mentioned above.

So you should either install a HF (with configs for masking data) and direct your UF's to send to the HF - and of course set the HF to send to your indexer(s). Or you install a HF on each source system instead of a UF, and then you can deploy a masking app via DS.

/k

[jmallorquin · Accepted solution]

Hi,

You can use a HeavyForwader to send the coocked data to the indexer. In the heavy forwarder you can anonymize the info.

Hope i help you.

[SirHill17]

Thanks for that, I read the doc and it's what I was looking for.

Just a question about it, is it possible to forward only some defined indexes or it will duplicate every index ? I am asking that checking at the message in the config:

Data will be auto load balanced to each host:port

Thanks!

[kristian_kolb]

Check this out.

https://answers.splunk.com/answers/339930/how-do-forwardedindex-whitelists-and-blacklists-wo.html

/K

[SirHill17]

Great, thanks

[jmallorquin]

Ofcourse,

You can use props.conf and transforms.conf to routing the events that you want.

Hope i help you.