Is data scrubbing only available for specified roles?

[mcarpentier]

Hi all,
I know Splunk can replace identifying datas at search time, however I don't know if this can be done for specified roles only?
Many employees in our company may not have the necessary accreditation to view our customers' IP or emails, but I'd like them to access scrubbed logs. While others may have full access to the unscrubbed logs.

Is this possible via Splunk ? Thanks for your answer.

[esix_splunk · Accepted solution]

There's no out of the box capability for this. I'll also point out, if your taking about accreditation requirements, typically search time masking is insufficient as users can still drill down / search the raw. Index time masking is the only solution in that sort of scenario.

ThAt being said, you could used role based access control to create indexes based on roles, and scrub data on a per index basis. However that's a long and tedious process and would require full time admins to do this. You'd basically have to index the data, then use summary indexing to collect and scrub the existing data. Very time consuming.

[mcarpentier]

Thanks, didn't know about summary indexing, gonna read some documentation on this.
If i create two indexes, one scrubbed and one with raw events, does that means i'll be charged twice (talking about license) ?
Also i'm not used to splunk yet to understand how much time consuming would that be, i'd imagine splunk can automatically do this....but if you say so i trust you !

[twinspop]

Summary indexing doesn't count against your license. Yes, it could be done automatically, but will probably require non-trivial care and feeding.

[mcarpentier]

perfect, thanks !