Splunk Search

Modify values after they are indexed

Explorer

Hi,
i have personal data stored in Splunk like a first/last name, example FN=JOHN LN=PUBLIC .
Due to common data protection laws i'm getting asked to delete those records after a period of time.
Since i don't want to delete the entire record i'm wondering if it is possible to modify those values afterwards to say FN=XXXXX LN=YYYYYY .

Is this somehow possible?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

It's not possible, but you could censor the records into another index using the search command collect before deleting them.

View solution in original post

Splunk Employee
Splunk Employee

It's not possible, but you could censor the records into another index using the search command collect before deleting them.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!