Security

Mask Splunk access logs

BryanBerry
Path Finder

I'm wondering if it's possible to mask/scrub the Splunk access logs. If so, how?

It's for a security requirement. We have a search page that does a one-way hash of an input value and searches for the hash, but we don't want any written record of the input value. This value would appear in the Splunk access logs for a given request.

Edit:
I would like to do this for the Splunk access logs on the filesystem.

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

It is likely not possible to mask these directly in the Splunk access logs before they are written to flat files on disk. It may be possible with some deep hacking into Splunkweb and/or new framework (written in python) - but if it is showing up in the splunkd_access.log, then that's compiled C++ code that you cannot even change.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

It is likely not possible to mask these directly in the Splunk access logs before they are written to flat files on disk. It may be possible with some deep hacking into Splunkweb and/or new framework (written in python) - but if it is showing up in the splunkd_access.log, then that's compiled C++ code that you cannot even change.

0 Karma

BryanBerry
Path Finder

Not the answer I was hoping for, but an effective answer. Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, yes you can. You will need to make a transforms for the splunkd_access logs. Ref: http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Transformsconf

props.conf
[splunkd_access]
TRANSFORMS-splunkdhash = splunkd-masker

transforms.conf
[splunkd-masker]
REGEX = (?m)^(.*)fieldofhash=YOUR_REGEX_FOR_HASH(.*)$
FORMAT = $1=anonyhash$2
DEST_KEY = _raw

alacercogitatus
SplunkTrust
SplunkTrust

Then no. Splunkd writes those out. You could cron a script to replace in the file, but then Splunk re-indexes it.

0 Karma

BryanBerry
Path Finder

Sorry, I wasn't clear. I mean to mask Splunk's access logs on the filesystem itself.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...