Hello, new Splunk user here. I have some syslog events that have a field automatically extracted named "user". In the top values of this field, one of the usernames is masked as `'*****'`. But when I search for these events, the user name is clearly shown in the actual event data. It is also masked in the top 10. I have searched my config files for the string `'*****'` looking for some anonymize logic, but I can't find any. Can someone help me figure out where to look?
↧