Let's say I have an index that contains events with cleartext passwords. I can delete those events and they are no longer searchable in the UI, but the raw data still exists in the **journal.gz** file. Is it possible to modify that journal.gz file so that it will still be searchable, but the password is obfuscated? For example the original:
... thing1=thisismypassword ...
becomes:
... thing1=XXXXXXXXXXXXXXXX ...
having the same number of characters, just not the actual password.
I'm not sure how the Splunk indexing relies on the data being exactly as it was created in the **journal.gz** file.
↧