anonymize before indexed_extractions

goelli · ‎12-12-2015

Hi,

I have a CSV input and want to anonymize data, but with SEDCMD it only works for _raw field. The fields created from indexed_extractions are not anonymized.
The fields of the CSV vary and the pattern I need to anonymize can occur in multiple fields.

Does anybody have a hint for me?

Best regards,
Thomas

martin_mueller · ‎12-13-2015

My colleague Johannes @jeffland had a similar issue, and provides a working solution here: https://answers.splunk.com/answers/312173/how-can-i-anonymize-fields-of-data-that-has-underg.html
The approach of modifying _meta directly should help you with looking for a pattern in varying fields.

anonymize before indexed_extractions

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: The Agentic SOC in Action with Enterprise Security Agents

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Join the Conversation

anonymize before indexed_extractions

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: The Agentic SOC in Action with Enterprise Security Agents

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path