{"id":18538,"date":"2025-08-20T10:35:33","date_gmt":"2025-08-20T14:35:33","guid":{"rendered":"https:\/\/www.iri.com\/blog\/?p=18538"},"modified":"2026-10-05T13:39:53","modified_gmt":"2026-10-05T17:39:53","slug":"masking-pii-in-splunk-redis-cosmosdb","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/","title":{"rendered":"Masking PII in Splunk, Redis &#038; CosmosDB"},"content":{"rendered":"<h2><strong>Editor\u2019s Note<\/strong><\/h2>\n<p><i><span style=\"font-weight: 400;\">This is the third article in a series of articles on using<\/span><\/i> <a href=\"https:\/\/www.iri.com\/products\/darkshield\"><i><span style=\"font-weight: 400;\">IRI DarkShield<\/span><\/i><\/a><i><span style=\"font-weight: 400;\"> to search and mask sensitive data in NoSQL databases. IRI Workbench GUI for DarkShield currently supports the following NoSQL databases:<\/span><\/i><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Cassandra<\/span><\/i><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Elasticsearch<\/span><\/i><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">MongoDB<\/span><\/i><\/li>\n<\/ul>\n<p><i><span style=\"font-weight: 400;\">For detailed instructions on using the DarkShield wizard with these databases and their configuration requirements, refer to <\/span><\/i><a href=\"https:\/\/www.iri.com\/blog\/data-protection\/finding-and-masking-nosql-dbs-with-the-darkshield-gui\/\"><i><span style=\"font-weight: 400;\">this article<\/span><\/i><\/a><i><span style=\"font-weight: 400;\">.<\/span><\/i><\/p>\n<h2><strong>Introduction<\/strong><\/h2>\n<p><span style=\"font-weight: 400;\">To extend its reach and performance, DarkShield now front-ends support for three additional NoSQL database technologies: Splunk, Redis, and CosmoDB. Specifically, this article demonstrates how to use the <a href=\"https:\/\/www.iri.com\/products\/workbench\/darkshield-gui\/nosql-masking\">IRI Workbench GUI for DarkShield<\/a> to discover and mask sensitive data within these platforms.<\/span><\/p>\n<h2><strong>Overview of Splunk, Redis, and CosmosDB<\/strong><\/h2>\n<p><b>Splunk<\/b><span style=\"font-weight: 400;\"> is a powerful analytical platform for searching, monitoring, and visualizing machine-generated data. In particular, Splunk logs and event data may contain IP addresses, user IDs, and other identifiers that require masking before sharing or reporting.<\/span><\/p>\n<p>By comparison, <strong>Redis<\/strong> is a high-performance in-memory key-value store commonly used for caching, session management, and real-time analytics.<span style=\"font-weight: 400;\">\u00a0Redis Enterprise builds on Redis Open Source, offering a flexible set of data structures and a rich module ecosystem\u2013 not just as a cache, but as a versatile multi-model NoSQL store. As a NoSQL database, Redis may store personally identifiable information (PII) such as user session data, authentication tokens, or personal preferences\u2014data that may require masking to prevent potential leaks.<\/span><\/p>\n<p><b>Azure Cosmos DB for NoSQL <\/b><span style=\"font-weight: 400;\">is Microsoft Azure\u2019s fully managed NoSQL database solution designed for fast, scalable, and globally distributed applications. It uses a JSON document model and enables users to query and manage data with SQL-like syntax. Consequently, Cosmos DB may contain PII such as names, email addresses, and contact information that requires protection through masking.<\/span><\/p>\n<h2><strong>Prerequisites<\/strong><\/h2>\n<p>First, complete the following prerequisites before launching the DarkShield NoSQL wizard:<\/p>\n<p><b>1. Set the API Directory<\/b><b><br \/>\n<\/b><span style=\"font-weight: 400;\"> Verify that the DarkShield API distribution directory has been specified in IRI Preferences.\u00a0<\/span><span style=\"font-weight: 400;\">For this purpose, go to <\/span><i><span style=\"font-weight: 400;\">IRI Workbench <img loading=\"lazy\" decoding=\"async\" class=\"\" title=\"\" src=\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXddCXzDUxBo2NWRv-t_q6Eihtbft2APhcxn1vo8YfvqJSeWxJMCw8Opr7RihUYG2TsE-TbCB1EvYuSizX6xqzIEcOZ-eVcQQjqTOwErTSUKyqgonyuusTQ0-EvSCGZ0pakj9fblwA?key=w7L5Fj9Rti9vEBxy7r0aCQ\" alt=\"\" width=\"25\" height=\"24\" \/><span class=\"c11 c29\">\u00a0<\/span> <\/span><\/i><i><span style=\"font-weight: 400;\">Preferences &gt; IRI &gt; DarkShield.<\/span><\/i><span style=\"font-weight: 400;\"> From here, you can configure both DarkShield GUI and API preferences, including the host, port, and directory where the DarkShield API resides. This is also where you can start the Darkshield Server.<\/span><\/p>\n<p><b>2. Create a Project with a Library<\/b><b><br \/>\n<\/b><span style=\"font-weight: 400;\"> All DarkShield wizards require a project that includes an <\/span><a href=\"https:\/\/www.iri.com\/blog\/data-protection\/iri-data-classification\/\"><span style=\"font-weight: 400;\">IRI Data Class and Rule Library<\/span><\/a><span style=\"font-weight: 400;\">. This library must contain at least one Data Class and a masking Rule assigned to it.<\/span><\/p>\n<p><b>3. Verify Data Access Permissions<\/b><b><br \/>\n<\/b><span style=\"font-weight: 400;\">The DarkShield API must have read and write access to your NoSQL data silos. Each NoSQL database type uses a different SDK for connectivity and CRUD operations. As a result, connection credentials and configuration details may vary by database.<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/p>\n<h3><span style=\"font-weight: 400;\"><strong>Using the Wizard<\/strong><\/span><\/h3>\n<p>Next, launch the wizard from the DarkShield menu by\u00a0<span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">selecting<em> New<\/em><\/span><i><span style=\"font-weight: 400;\">\u00a0NoSQL DB\u00a0 Search\/Masking Job<\/span><\/i><span style=\"font-weight: 400;\">\u2026. This opens the first page, where you\u2019ll give your job a new name.<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18541\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Search-Masking-wizard-300x279.png\" alt=\"IRI DarkShield New NoSQL Search\/Masking Job wizard for creating a Cosmos DB search and mask job\" width=\"396\" height=\"368\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Search-Masking-wizard-300x279.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Search-Masking-wizard.png 494w\" sizes=\"(max-width: 396px) 100vw, 396px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Afterward, click <\/span><i><span style=\"font-weight: 400;\">Next &gt; <\/span><\/i><span style=\"font-weight: 400;\">to define the details of the data you want to find and how it should be masked.<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18542\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard-300x279.png\" alt=\"IRI DarkShield Data Class and Masking Rule Selection page for a NoSQL masking job\" width=\"404\" height=\"376\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard-300x279.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard.png 496w\" sizes=\"(max-width: 404px) 100vw, 404px\" \/><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18543\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard_CosmoDB-300x279.png\" alt=\"DarkShield NoSQL wizard with PII data classes selected for Cosmos DB masking\" width=\"424\" height=\"394\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard_CosmoDB-300x279.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Data-class-masking-rule-wizard_CosmoDB.png 497w\" sizes=\"(max-width: 424px) 100vw, 424px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Then, on the Assign Masking Rules to Data Classes page, assign a masking rule to a data class and\/ or data class group to define how PII will be masked.<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18544\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/assign-masking-rules-to-data-class-wizard-300x280.png\" alt=\"IRI DarkShield wizard assigning masking rules to email, first name, phone number, and last name data classes\" width=\"437\" height=\"408\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/assign-masking-rules-to-data-class-wizard-300x280.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/assign-masking-rules-to-data-class-wizard.png 494w\" sizes=\"(max-width: 437px) 100vw, 437px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Finally, click <\/span><i><span style=\"font-weight: 400;\">Next &gt;<\/span><\/i><span style=\"font-weight: 400;\"> to select the NoSQL silo you want to search and mask.<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18545\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/NoSql-source-wizard-300x279.png\" alt=\"DarkShield NoSQL Source wizard showing Cassandra, Elasticsearch, MongoDB, Splunk, Redis, and Cosmos DB options\" width=\"443\" height=\"412\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/NoSql-source-wizard-300x279.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/NoSql-source-wizard.png 494w\" sizes=\"(max-width: 443px) 100vw, 443px\" \/><\/p>\n<h4><strong>Connection Credentials<\/strong><\/h4>\n<p><span style=\"font-weight: 400;\">With the NoSQL database type selected, the next step is to create a new connection configuration, which gets saved in the connection registry:<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18546\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/new-connection-configuration-300x71.png\" alt=\"IRI Workbench Dark Data Connections registry listing Cosmos DB, Redis, and Splunk connections\" width=\"600\" height=\"142\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/new-connection-configuration-300x71.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/new-connection-configuration-768x183.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/new-connection-configuration.png 811w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Example of Darkshield connection registry<\/span><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18547\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Example-of-Darkshield-connection-registry-300x279.png\" alt=\"DarkShield NoSQL Source wizard with a saved Cosmos DB connection configuration selected\" width=\"455\" height=\"423\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Example-of-Darkshield-connection-registry-300x279.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Example-of-Darkshield-connection-registry.png 495w\" sizes=\"(max-width: 455px) 100vw, 455px\" \/><\/p>\n<p style=\"text-align: left;\"><span style=\"font-weight: 400;\">Depending on the database and scope of your search within it, the connection parameters vary:<\/span><\/p>\n<h2><strong>Splunk Source Definitions<\/strong><\/h2>\n<h3><span style=\"font-weight: 400;\">Index Search Configuration<\/span><\/h3>\n<p style=\"text-align: center;\"><span style=\"font-weight: 400;\">\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18548\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-Index-Search-300x246.png\" alt=\"Splunk connection configuration in DarkShield with URL, credentials, index, and index search scope\" width=\"457\" height=\"375\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-Index-Search-300x246.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-Index-Search.png 543w\" sizes=\"(max-width: 457px) 100vw, 457px\" \/><\/span><\/p>\n<ul>\n<li><b><i>Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> A user-defined name for the connection configuration<\/span><\/i><\/li>\n<li><b><i>URL:<\/i><\/b><i><span style=\"font-weight: 400;\"> The Splunk instance URL<\/span><\/i><\/li>\n<li><b><i>Username &amp; Password: <\/i><\/b><i><span style=\"font-weight: 400;\">Log-in credentials for user<\/span><\/i><\/li>\n<li><b><i>Index:<\/i><\/b> <i><span style=\"font-weight: 400;\">The Splunk index to search within\u00a0<\/span><\/i><\/li>\n<li><b><i>Scope of operation: <\/i><\/b><i><span style=\"font-weight: 400;\">An index search will search and mask PII within all contents within the specified index.<\/span><\/i><\/li>\n<\/ul>\n<h3>Query Search Configuration<\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18551\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-web-search-300x110.png\" alt=\"Splunk Enterprise search bar with index and source criteria for a query search\" width=\"401\" height=\"147\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-web-search-300x110.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-web-search.png 511w\" sizes=\"(max-width: 401px) 100vw, 401px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Splunk Web search bar with specified search criteria<\/span><\/i><i><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18552\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/splunk-connection-config-300x261.png\" alt=\"DarkShield Splunk connection configuration using query search criteria\" width=\"489\" height=\"425\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/splunk-connection-config-300x261.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/splunk-connection-config.png 512w\" sizes=\"(max-width: 489px) 100vw, 489px\" \/><\/p>\n<ul>\n<li><b><i>Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> A user-defined name for the connection configuration<\/span><\/i><\/li>\n<li><b><i>URL:<\/i><\/b><i><span style=\"font-weight: 400;\"> The Splunk instance URL<\/span><\/i><\/li>\n<li><b><i>Username &amp; Password: <\/i><\/b><i><span style=\"font-weight: 400;\">Log-in credentials for user<\/span><\/i><\/li>\n<li><b><i>Index:<\/i><\/b> <i><span style=\"font-weight: 400;\">The Splunk index to search within\u00a0<\/span><\/i><\/li>\n<li><b><i>Scope of operation: <\/i><\/b><i>Instead, a query search limits the operation according to the specified search criteria.<\/i><i><span style=\"font-weight: 400;\"> Otherwise, Splunk performs an \u201cAll time\u201d search when the query does not specify a time range.<\/span><\/i><\/li>\n<\/ul>\n<h2><strong>Redis Source Definition<\/strong><\/h2>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18554\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-config-300x260.png\" alt=\"Redis connection configuration in DarkShield with host, port, key name, username, and password\" width=\"466\" height=\"404\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-config-300x260.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-config.png 512w\" sizes=\"(max-width: 466px) 100vw, 466px\" \/><\/p>\n<p>Similarly, Redis requires connection details that identify the server and the keys DarkShield should search.<\/p>\n<ul>\n<li><b><i>Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> A user-defined name for the connection configuration<\/span><\/i><\/li>\n<li><b><i>Host:<\/i><\/b><i><span style=\"font-weight: 400;\"> The hostname or IP address of the Redis server<\/span><\/i><\/li>\n<li><b><i>Port:<\/i><\/b><i><span style=\"font-weight: 400;\"> The port number on which the Redis server is listening (default is 6379)<\/span><\/i><\/li>\n<li><b><i>Key Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> The Redis key or key pattern to search within<\/span><\/i><\/li>\n<li><b><i>Username &amp; Password: <\/i><\/b><i><span style=\"font-weight: 400;\">This setting is optional, depending on how your security is set up.<\/span><\/i><\/li>\n<\/ul>\n<h2><strong>CosmosDB Source Definitions<\/strong><\/h2>\n<h3><span style=\"font-weight: 400;\">Database Search Configuration<\/span><\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18555\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-config-300x261.png\" alt=\"Cosmos DB connection configuration in DarkShield for a database search\" width=\"501\" height=\"436\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-config-300x261.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-config.png 512w\" sizes=\"(max-width: 501px) 100vw, 501px\" \/><\/p>\n<ul>\n<li><b><i>Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> A user-defined name for the connection configuration<\/span><\/i><\/li>\n<li><b><i>URI:<\/i><\/b><i><span style=\"font-weight: 400;\"> The URI of CosmosDB instance.<\/span><\/i><\/li>\n<li><b><i>Primary Key:<\/i><\/b><i><span style=\"font-weight: 400;\"> The primary key for a CosmosDB connection<\/span><\/i><\/li>\n<li><b><i>Database:<\/i><\/b><i><span style=\"font-weight: 400;\"> The database to search within<\/span><\/i><\/li>\n<li><b><i>Scope of operation: <\/i><\/b><i><span style=\"font-weight: 400;\">A database search will search and mask PII within all contents within the specified database.<\/span><\/i><\/li>\n<\/ul>\n<h3><span style=\"font-weight: 400;\">Container Search Configuration<\/span><\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18556\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-container-search-300x260.png\" alt=\"Cosmos DB connection configuration in DarkShield for a container search\" width=\"539\" height=\"467\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-container-search-300x260.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmos-db-container-search.png 514w\" sizes=\"(max-width: 539px) 100vw, 539px\" \/><\/p>\n<p>Alternatively, a container search limits the operation to the specified Cosmos DB container.<\/p>\n<ul>\n<li><b><i>Name:<\/i><\/b><i><span style=\"font-weight: 400;\"> A user-defined name for the connection configuration<\/span><\/i><\/li>\n<li><b><i>URI:<\/i><\/b><i><span style=\"font-weight: 400;\"> The URI of CosmosDB instance<\/span><\/i><\/li>\n<li><b><i>Primary Key:<\/i><\/b><i><span style=\"font-weight: 400;\"> Primary key for CosmosDB connection<\/span><\/i><\/li>\n<li><b><i>Database:<\/i><\/b><i><span style=\"font-weight: 400;\"> The database to search within<\/span><\/i><\/li>\n<li><b><i>Scope of operation: <\/i><\/b><i><span style=\"font-weight: 400;\">A container search will search and mask PII within all contents within the specified container.<\/span><\/i><\/li>\n<\/ul>\n<h2><strong>Target Definition<\/strong><\/h2>\n<p>After that, the NoSQL Target page defines where DarkShield will write the masked data.<span style=\"font-weight: 400;\"> Creating a connection configuration for a data target follows the same steps as creating a data source.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">To create a new connection configuration for a target, click <\/span><i><span style=\"font-weight: 400;\">New\u2026<\/span><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18557\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Target-300x280.png\" alt=\"DarkShield NoSQL Target page with Cosmos DB selected as the masked data target\" width=\"478\" height=\"446\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Target-300x280.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/New-NoSQL-Target.png 494w\" sizes=\"(max-width: 478px) 100vw, 478px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Creating a connection configuration for a data target follows the same steps as creating a data source.\u00a0<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18558\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Cosmo-db_creating-a-connection-configuration-300x261.png\" alt=\"Cosmos DB target connection configuration with a masked database name in DarkShield\" width=\"485\" height=\"422\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Cosmo-db_creating-a-connection-configuration-300x261.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Cosmo-db_creating-a-connection-configuration.png 513w\" sizes=\"(max-width: 485px) 100vw, 485px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Example of a CosmosDB target connection registry<\/span><\/i><\/p>\n<p>For example, the configuration above names a new database, so DarkShield creates it automatically to receive the masked data.<\/p>\n<p><span style=\"font-weight: 400;\">Once you configure the target silo for the masked data, click <\/span><i><span style=\"font-weight: 400;\">Finish<\/span><\/i><span style=\"font-weight: 400;\"> to add it to the connection registry.\u00a0<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18560\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmosdb-target-300x281.png\" alt=\"DarkShield NoSQL Target wizard showing the saved Cosmos DB target connection\" width=\"481\" height=\"450\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmosdb-target-300x281.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/cosmosdb-target.png 538w\" sizes=\"(max-width: 481px) 100vw, 481px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Alternatively, you can click <\/span><i><span style=\"font-weight: 400;\">Finish <\/span><\/i><span style=\"font-weight: 400;\">to use the same configurations as the source. <\/span><b>But note that if you just re-use the source configuration in the target, your original source data will be overwritten.<\/b><\/p>\n<h2><strong>Review &amp; Run the Job<\/strong><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/h2>\n<p>Subsequently, click <i><span style=\"font-weight: 400;\">Finish<\/span><\/i> after selecting the NoSQL target to generate the DarkShield configuration (.dsc) file.<span style=\"font-weight: 400;\">\u00a0Job details appear in, and can be edited in the IRI Workbench dialog like this:<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18561\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Job-details_DarkShield-300x159.png\" alt=\"IRI DarkShield job details showing source, target, filters, and masking configuration for a NoSQL job\" width=\"776\" height=\"411\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Job-details_DarkShield-300x159.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Job-details_DarkShield-1024x543.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Job-details_DarkShield-768x407.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Job-details_DarkShield.png 1055w\" sizes=\"(max-width: 776px) 100vw, 776px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">The IRI DarkShield Configuration (.dsc) file for a CosmosDB search and mask job<\/span><\/i><\/p>\n<p>If you change the configuration, then save the job before running it.<\/p>\n<p><span style=\"font-weight: 400;\">To run a DarkShield Search and Mask Job right, click the .dsc file and select<\/span><i><span style=\"font-weight: 400;\"> IRI &gt; Run Search and Masking Job<\/span><\/i><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18562\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Run-search-300x274.png\" alt=\"IRI Workbench menu option for running a DarkShield search and masking job\" width=\"481\" height=\"439\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Run-search-300x274.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Run-search.png 660w\" sizes=\"(max-width: 481px) 100vw, 481px\" \/><\/p>\n<p>Thereafter, DarkShield writes the masked PII to the target silo you specified.<\/p>\n<p>To illustrate, the examples below compare the original unmasked data with the masked results.<\/p>\n<h3><strong>Data Masking Example in Splunk<\/strong><\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18572\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-unprotected2-300x164.png\" alt=\"Splunk index before masking with unprotected sensitive values visible in event data\" width=\"821\" height=\"449\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-unprotected2-300x164.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-unprotected2-1024x561.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-unprotected2-768x421.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-unprotected2.png 1180w\" sizes=\"(max-width: 821px) 100vw, 821px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Splunk index unprotected<\/span><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18573\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-protected2-300x164.png\" alt=\"Splunk index after DarkShield masking with protected sensitive values in event data\" width=\"765\" height=\"418\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-protected2-300x164.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-protected2-1024x560.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-protected2-768x420.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Splunk-index-protected2.png 1179w\" sizes=\"(max-width: 765px) 100vw, 765px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Splunk index protected<\/span><\/i><\/p>\n<h3><strong>Masked Data Example in Redis<\/strong><\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18565\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-unprotected-300x191.png\" alt=\"Redis hash before masking with unprotected personal data fields and values\" width=\"692\" height=\"441\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-unprotected-300x191.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-unprotected-768x489.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-unprotected.png 993w\" sizes=\"(max-width: 692px) 100vw, 692px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Redis hash unprotected<\/span><\/i><i><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18566\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-protected-300x189.png\" alt=\"Redis hash after DarkShield masking with protected personal data values\" width=\"713\" height=\"449\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-protected-300x189.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-protected-768x485.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Redis-hash-protected.png 993w\" sizes=\"(max-width: 713px) 100vw, 713px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Redis hash protected<\/span><\/i><\/p>\n<h3><strong>CosmosDB\u00a0 Data Masking Example<\/strong><\/h3>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18567\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-unprotected-300x84.png\" alt=\"Azure Cosmos DB item before masking with unprotected personal data in a JSON document\" width=\"739\" height=\"207\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-unprotected-300x84.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-unprotected-1024x285.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-unprotected-768x214.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-unprotected.png 1031w\" sizes=\"(max-width: 739px) 100vw, 739px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">Before masking in Cosmos DB<\/span><\/i><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18568\" src=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-protected-300x89.png\" alt=\"Azure Cosmos DB item after DarkShield masking with protected personal data in a JSON document\" width=\"768\" height=\"228\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-protected-300x89.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-protected-768x227.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/CosmosDB-item-protected.png 953w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/p>\n<p style=\"text-align: center;\"><i><span style=\"font-weight: 400;\">After masking in Cosmos DB<\/span><\/i><\/p>\n<p>Overall, DarkShield applies the assigned masking rule consistently across structured, semi-structured, and unstructured sources.<span style=\"font-weight: 400;\">\u00a0And when the masking rule is a deterministic masking function like format-preserving encryption, you can preserve referential integrity (masked value consistency) in every enterprise target.<\/span><\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3><strong>Which NoSQL platforms does DarkShield support in this workflow?<\/strong><\/h3>\n<p>DarkShield supports Splunk, Redis, and Azure Cosmos DB in this article, in addition to other NoSQL platforms such as Cassandra, Elasticsearch, and MongoDB.<\/p>\n<h3><strong>Can DarkShield search and mask PII in both Splunk indexes and query results?<\/strong><\/h3>\n<p>Yes. DarkShield can search an entire Splunk index or use query criteria to limit the scope of the search and masking operation.<\/p>\n<h3><strong>How does DarkShield connect to Redis?<\/strong><\/h3>\n<p>A Redis connection uses the server host, port, key name or key pattern, and optional credentials depending on the security configuration.<\/p>\n<h3><strong>Can DarkShield search an entire Cosmos DB database or just one container?<\/strong><\/h3>\n<p>Yes. DarkShield supports both database-level and container-level searches in Azure Cosmos DB.<\/p>\n<h3><strong>Can masked data be written to a different NoSQL target?<\/strong><\/h3>\n<p>Yes. The NoSQL Target step lets users select a separate target connection for the masked data or reuse the source configuration.<\/p>\n<h3><strong>What happens if the source and target use the same configuration?<\/strong><\/h3>\n<p>If the same source configuration is reused as the target, the original data can be overwritten.<\/p>\n<h3><strong>How does DarkShield keep masked values consistent across different data sources?<\/strong><\/h3>\n<p>Deterministic masking methods such as format-preserving encryption can preserve masked-value consistency and referential integrity across enterprise targets.<\/p>\n<h3><strong>Where are masking rules defined in a DarkShield NoSQL job?<\/strong><\/h3>\n<p>Masking rules are assigned to data classes or data class groups in the wizard before the source and target NoSQL systems are selected.<\/p>\n<p><span style=\"font-weight: 400;\">If you would like more information about, or assistance with, discovering or de-identifying PII or other sensitive data in your on-premises or cloud sources, please email <\/span><a href=\"mailto:darkshield@iri.com\"><span style=\"font-weight: 400;\">darkshield@iri.com<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Editor\u2019s Note This is the third article in a series of articles on using IRI DarkShield to search and mask sensitive data in NoSQL databases. IRI Workbench GUI for DarkShield currently supports the following NoSQL databases: Cassandra Elasticsearch MongoDB For detailed instructions on using the DarkShield wizard with these databases and their configuration requirements, refer<\/p>\n<div><a class=\"btn-filled btn\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\" title=\"Masking PII in Splunk, Redis &#038; CosmosDB\">Read More<\/a><\/div>\n","protected":false},"author":220,"featured_media":18570,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[8],"tags":[2175,1941,2174,340,14,18,15,1469,2176,98,1388,850,533,2173,1815,1632,240,1750,574],"class_list":["post-18538","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection","tag-cassandra","tag-compliance","tag-cosmos-db","tag-data-governance","tag-data-masking","tag-data-privacy","tag-data-security","tag-elasticsearch","tag-enterprise-security","tag-format-preserving-encryption","tag-iri-darkshield","tag-iri-workbench","tag-mongodb","tag-nosql-databases","tag-pii-protection","tag-redis","tag-referential-integrity","tag-sensitive-data-protection","tag-splunk"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.4 (Yoast SEO v23.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>NoSQL Data Masking in Splunk, Redis &amp; Cosmos DB | IRI<\/title>\n<meta name=\"description\" content=\"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Masking PII in Splunk, Redis &amp; CosmosDB\" \/>\n<meta property=\"og:description\" content=\"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-20T14:35:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-05T17:39:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1110\" \/>\n\t<meta property=\"og:image:height\" content=\"532\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Anastassia Aguilar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Anastassia Aguilar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\"},\"author\":{\"name\":\"Anastassia Aguilar\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/106ab89e771e050cb1afca672f4a8f30\"},\"headline\":\"Masking PII in Splunk, Redis &#038; CosmosDB\",\"datePublished\":\"2025-08-20T14:35:33+00:00\",\"dateModified\":\"2026-10-05T17:39:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\"},\"wordCount\":1485,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png\",\"keywords\":[\"Cassandra\",\"Compliance\",\"Cosmos DB\",\"data governance\",\"data masking\",\"data privacy\",\"data security\",\"Elasticsearch\",\"Enterprise Security\",\"format-preserving encryption\",\"IRI DarkShield\",\"IRI Workbench\",\"MongoDB\",\"NoSQL Databases\",\"PII protection\",\"Redis\",\"referential integrity\",\"sensitive data protection\",\"Splunk\"],\"articleSection\":[\"Data Masking\/Protection\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\",\"name\":\"NoSQL Data Masking in Splunk, Redis & Cosmos DB | IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png\",\"datePublished\":\"2025-08-20T14:35:33+00:00\",\"dateModified\":\"2026-10-05T17:39:53+00:00\",\"description\":\"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png\",\"width\":1110,\"height\":532,\"caption\":\"NoSQL data masking in Splunk, Redis, and Azure Cosmos DB with IRI DarkShield\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Masking PII in Splunk, Redis &#038; CosmosDB\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/106ab89e771e050cb1afca672f4a8f30\",\"name\":\"Anastassia Aguilar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9b7f7e9b3061c86c8452a44ef565ebc2?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9b7f7e9b3061c86c8452a44ef565ebc2?s=96&d=blank&r=g\",\"caption\":\"Anastassia Aguilar\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/aaguilariri-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"NoSQL Data Masking in Splunk, Redis & Cosmos DB | IRI","description":"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/","og_locale":"en_US","og_type":"article","og_title":"Masking PII in Splunk, Redis & CosmosDB","og_description":"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/","og_site_name":"IRI","article_published_time":"2025-08-20T14:35:33+00:00","article_modified_time":"2026-10-05T17:39:53+00:00","og_image":[{"width":1110,"height":532,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","type":"image\/png"}],"author":"Anastassia Aguilar","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Anastassia Aguilar","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/"},"author":{"name":"Anastassia Aguilar","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/106ab89e771e050cb1afca672f4a8f30"},"headline":"Masking PII in Splunk, Redis &#038; CosmosDB","datePublished":"2025-08-20T14:35:33+00:00","dateModified":"2026-10-05T17:39:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/"},"wordCount":1485,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","keywords":["Cassandra","Compliance","Cosmos DB","data governance","data masking","data privacy","data security","Elasticsearch","Enterprise Security","format-preserving encryption","IRI DarkShield","IRI Workbench","MongoDB","NoSQL Databases","PII protection","Redis","referential integrity","sensitive data protection","Splunk"],"articleSection":["Data Masking\/Protection"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/","name":"NoSQL Data Masking in Splunk, Redis & Cosmos DB | IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","datePublished":"2025-08-20T14:35:33+00:00","dateModified":"2026-10-05T17:39:53+00:00","description":"Understand how NoSQL data masking with IRI DarkShield finds and protects PII in Splunk, Redis, and Azure Cosmos DB using configurable search and masking jobs.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","width":1110,"height":532,"caption":"NoSQL data masking in Splunk, Redis, and Azure Cosmos DB with IRI DarkShield"},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-pii-in-splunk-redis-cosmosdb\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Masking PII in Splunk, Redis &#038; CosmosDB"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/106ab89e771e050cb1afca672f4a8f30","name":"Anastassia Aguilar","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/9b7f7e9b3061c86c8452a44ef565ebc2?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9b7f7e9b3061c86c8452a44ef565ebc2?s=96&d=blank&r=g","caption":"Anastassia Aguilar"},"url":"https:\/\/www.iri.com\/blog\/author\/aaguilariri-com\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/08\/Masking-PII-splunk-redis-cosmosdb.png","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18538"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/220"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=18538"}],"version-history":[{"count":15,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18538\/revisions"}],"predecessor-version":[{"id":19471,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18538\/revisions\/19471"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/18570"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=18538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=18538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=18538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}