Password hashing in Splunk

[anandhalagaras1]

In one of the file the password seems to be present and the same has been getting ingested into Splunk. So is there any way to hash the password for that field so that it wont be visible in Splunk during searching eventhough it is present in the logs.

[woodcock]

Moving forward, you can use SEDCMD to strip it:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
or INGEST_EVAL to hash it (I would not bother):
https://splunkonbigdata.com/2019/03/22/ingest_eval/
Moving backward, you will have to reprocess it from original raw events OR use collect to re-index from existing events (then go back and delete the old evetns):
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect

[PavelP]

I don't think it is possible, but I can suggest a workaround:
You can mask passwords with SEDCMD command during the ingestion and send it to one index and send unmodified events into other index, which can be accessed by you only.

Let me know if it solves your question. If not - try to describe your use case so may be somebody can give your better solution.