{"id":19563,"date":"2026-10-19T17:05:37","date_gmt":"2026-10-19T21:05:37","guid":{"rendered":"https:\/\/www.iri.com\/blog\/?p=19563"},"modified":"2026-10-19T17:05:37","modified_gmt":"2026-10-19T21:05:37","slug":"darkshield-pii-results-splunk","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/iri\/business\/darkshield-pii-results-splunk\/","title":{"rendered":"Analyzing DarkShield PII Results in Splunk"},"content":{"rendered":"

When analyzing security data, whether network traffic, personally identifiable information (PII) discovery logs, or real-time data from a firewall or router, Splunk Enterprise provides security engineers with several ways to examine and interpret the results.<\/p>\n

Using Splunk’s Search Processing Language (SPL), users can parse data, configure real-time monitoring for specific events (such as status codes), and visualize results through bar charts, time charts, and pie charts. These capabilities make Splunk useful for identifying patterns and gaining insights from security-related data.<\/p>\n

One important source of security information is the location data generated during sensitive data searches. IRI DarkShield<\/span><\/a>\u00a0is a data discovery and masking tool that identifies and conceals or removes sensitive information, including PII, PHI, CUI, and NPI.<\/p>\n

DarkShield organizes sensitive information into defined data classes<\/a>, such as Social Security numbers (SSNs), email addresses, physical addresses, and phone numbers. These classes are paired with search methods (matchers) and masking rules to support consistent discovery and protection across structured, semi-structured, and unstructured data sources<\/a>, including databases, EDI files, documents, and images.<\/p>\n

Importing DarkShield search logs into Splunk, a Security Information and Event Management (SIEM) tool, allows users to analyze and visualize the occurrences of PII discovered in various data sources.<\/p>\n

DarkShield saves these results in delimited formats, such as Pipe Separated Value (PSV) files, or in JavaScript Object Notation (JSON) format. This article focuses on analyzing DarkShield JSON logs in Splunk.<\/p>\n

\"Workflow<\/p>\n

Understanding DarkShield JSON Logs<\/h2>\n

DarkShield search and masking jobs produce three different JSON logs:<\/p>\n

    \n
  1. \n
    \n
    \n

    annotations.json<\/code> contains the locations of sensitive data discovered during a search.<\/p>\n<\/div>\n<\/div>\n<\/li>\n

  2. \n
    \n
    \n

    results.json<\/code> also records masking functions and their associated ciphertext values.<\/p>\n<\/div>\n<\/div>\n<\/li>\n

  3. \n
    \n
    \n

    audit.json<\/code> provides general runtime and statistical information. These logs are compatible with the IRI CoSort v11 Operational Governance System (OGS)<\/a> logs produced by SortCL-compatible structured data processing jobs, such as those performed by FieldShield.<\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n

    Each log provides different information about DarkShield operations. The location and masking details in annotations.json<\/code> and results.json<\/code> can be examined separately from the operational information recorded in audit.json<\/code>.<\/p>\n

    In this article, I use the second log type, results.json<\/code>, to demonstrate what Splunk can reveal when analyzing a large collection of DarkShield runtime logs.<\/p>\n

    A separate article will examine Splunk insights obtained from OGS audit logs.<\/p>\n

    Importing DarkShield JSON Logs into Splunk<\/h2>\n

    To begin, upload your DarkShield logs into Splunk for ingestion.<\/p>\n

    Navigate to Settings > Add Data<\/strong>. Splunk will display a page where you can upload the files you want to analyze.<\/p>\n

    For this example, I combined various logs and audit files into a single ZIP file before uploading them.<\/p>\n

    When configuring the data import, set the source type to _json<\/code> so Splunk processes the JSON files appropriately.<\/p>\n

    It is also helpful to verify that the JSON files are formatted clearly before ingestion. If necessary, you can reformat unformatted JSON logs using a free tool such as Notepad++.\u00a0Once Splunk processes the uploaded files, it displays the log entries as events.<\/p>\n

    Searching DarkShield Logs in Splunk<\/h2>\n

    Basic searching in Splunk is straightforward. Enter a keyword into the search bar, and Splunk parses the indexed logs to return matching events.<\/p>\n

    For example, entering SSN<\/code> returns log entries containing the string SSN<\/code>.<\/p>\n

    Although keyword searches help locate specific information, statistical analysis requires extracting values from the appropriate JSON objects and arrays.<\/p>\n

    Extracting Data Classes with SPL<\/h3>\n

    To retrieve data class information from DarkShield logs, use the following Splunk Search Processing Language (SPL) commands:<\/p>\n