Anonymize data feature supported by universal forwarder or free version?


Is the anonymize data feature (through the props config file) supported by either a universal forwarder (without indexing) or the free version?

What I'm trying to setup is a Splunk instance that anonymizes certain data but does not have to index, and then forward the anonymized data to an already enterprise licensed Splunk environment. The receiving / indexing Splunk is run by a different group so sharing their license may be a bit more complex.

Thanks for any help


A Universal Forwarder does not parse its data, so it can not anonymize anything regardless of license level. You can however use a Heavy Forwarder to do parsing and anonymization before data is sent to the indexers. The HF doesn't need an enterprise license as long as it doesn't need to index data locally or has to support authentication.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...