Anonymize data feature supported by universal forwarder or free version?


Is the anonymize data feature (through the props config file) supported by either a universal forwarder (without indexing) or the free version?

What I'm trying to setup is a Splunk instance that anonymizes certain data but does not have to index, and then forward the anonymized data to an already enterprise licensed Splunk environment. The receiving / indexing Splunk is run by a different group so sharing their license may be a bit more complex.

Thanks for any help


A Universal Forwarder does not parse its data, so it can not anonymize anything regardless of license level. You can however use a Heavy Forwarder to do parsing and anonymization before data is sent to the indexers. The HF doesn't need an enterprise license as long as it doesn't need to index data locally or has to support authentication.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...