Modify values after they are indexed

[mkrauss1]

Hi,
i have personal data stored in Splunk like a first/last name, example FN=JOHN LN=PUBLIC .
Due to common data protection laws i'm getting asked to delete those records after a period of time.
Since i don't want to delete the entire record i'm wondering if it is possible to modify those values afterwards to say FN=XXXXX LN=YYYYYY .

Is this somehow possible?

[dart · Accepted solution]

It's not possible, but you could censor the records into another index using the search command collect before deleting them.