Knowledge Management

Manage data integrity: Would erasing a single log would impact the "integrity" of the logs causing a failure on the integrity check?

gascar
New Member

Hi all,

I had configured the data integrity on index=index_test of my Splunk infrastructure following the instruction on https://docs.splunk.com/Documentation/Splunk/6.3.3/Security/Dataintegritycontrol

Now I have the l1Hashes and l2Hash files as expected and I deleted, for testing, a single log from the index_test (from GUI whit "delete" command). But after performing a check-integrity command

 ./splunk check-integrity -index index_test 

I have no "failure", all check goes ok.
Is this an expected behaviour? My expectation was that erasing a single log would impact the "integrity" of the logs causing a failure on the integrity check. I'm missing something? Someone has experiences on this topic?

Thanks very much,
Gabriele

0 Karma

starcher
SplunkTrust
SplunkTrust

That’s not what the “delete” command does. It doesn’t truly delete anything. It marks events as not searchable. File system hashes are meant to catch OS level changes outside of Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...