Encrypt the Source data

[vijreddy30]

Hi All,

My requirement is source data records data need to be encrypted. What does process need to follow? Is there any possibly  props.conf ?

Please help me the process.

Regards,

Vij 

[gcusello]

Hi @vijreddy30,

what do you meam with encrypt source data?

are you speaking of encrypt the original files? it isn't a Splunk Matter,

are you speaking of data transmission, which kind of ingestions are you speaking about: forwarders, syslog, HEC?

if Forwarders, you can excrypt data between Forwarders and Indexers and there are checking technics inside Splunk.

If you're speaking of syslog: I hint to use an rsyslog server and read files using a Universal Forwarders; I'm not sure that's possible to encrypt syslogs; in addition, you could use two UFs and a Load Balancer to avoid Single Point of Failures,

If you're speaking of HEC, you can use https and the token is a securization of your ingestion; as syslogs, you should use two Forwarders and a Load Balancer.

if you're speaking of encryption on Splunk see at https://www.splunk.com/en_us/blog/learn/end-to-end-encryption.html?locale=en_us 

Ciao.

Giuseppe

[vijreddy30]

2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - Header Field Name: MOM_Caution_e_1, value is out of Bounds using beginIndex:608, endIndex:684 from line:
2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.Kpr.batchrecordprint.scheduledTasks - 02000011831199QD06620

my requirement is encrypt the WARN pool-1-........................ record the source file

please help me the process

[gcusello]

Hi @vijreddy30,

let me understand: do you want to mask some events or part of event in permanent way or in reversible way?

if in reversible way, you have to preprocess your data using a script and a certificate and then index your data using Splunk.

If you only want to anonymize a part of your data, follow the instructions at https://www.splunk.com/en_us/blog/learn/data-anonymization.html or https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata?_gl=1*b5bay4*_ga*MTY1NjIzMDM3...

Ciao.

Giuseppe