topic Re: splunk to monitor password protected files in Getting Data In

splunk to monitor password protected files

avinashreddy539 — Fri, 10 Oct 2014 07:32:53 GMT

Hi,
I am trying to configure splunk to monitor zip files. All the files inside the zip files are password protected and hence splunk is not able to index the data from those files. Is there a way i can pass password to splunk so that it can index those password protected files. Please help. Thanks in advance.

Re: splunk to monitor password protected files

jrodman — Fri, 10 Oct 2014 09:02:49 GMT

I don't believe we have support for zip 'encryption' in the splunk archive handling.

Obviously you could provide them to splunk unpacked, or repacked in non-password zip files for a limited time.

Re: splunk to monitor password protected files

peter_krammer — Fri, 10 Oct 2014 09:36:22 GMT

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

Re: splunk to monitor password protected files

avinashreddy539 — Fri, 10 Oct 2014 11:47:10 GMT

Hi Peter, Thanks for the reply. Can you please provide more details? Sorry. I am new to splunk. It would be great if you share any document.

Re: splunk to monitor password protected files

peter_krammer — Fri, 10 Oct 2014 12:10:00 GMT

I can only point you to how to configure scripted inputs, but you would have to write the script (unix or windows) yourself. A scripted input works by splunk executing a script and indizes any output the script generates.

How to configure inputs (generally):
http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Configureyourinputs

How to scripted input via the config files: (section "Scripted Input")
http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf

How to scripted input via the web gui:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_in_Splunk_Web