Getting Data In

split events to different indexes and sanitize for PII data

wbrooks
New Member

I have a use case where I need to store pii data in one index and sanitized data in another index. I can use the clone_sourcetype, which works, but the problem is I also want to take the generic data that has no PII data and put it in a third index. The idea is as follows:
1). store non-pii data in index1
2). store pii data in a protected index2
3). store the same pii data, but sanitized in a general index3

---incoming data
- no queries send to index1
- has queries send to index2
- send duplicate of index2 to index3 and sanitize with sed / transforms etc

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...