Does decrypt work in distributed search environments?

[ltawfall]

I can get this app to work fine, if I'm running in locally on an indexer. But not from a distributed search head.

index=_internal | decrypt field=sourcetype hex() emit('sourcetype')

Corresponding Errors:

[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.

Works when I go to each indexer and run the command but not from the search head.

I basically looking for any app/script that will do base64 decoding from a distributed set up. Thus far I can seem to find one.

Thanks,
Lisa

[bmacias84 · Accepted solution]

This app is missing a setting within the commands.conf. Add the following settings to decrypt/default/commands.conf local = true. If local=true, specifies that the command should be run on the search head only. The default is false. This should fix the issue.

Example commands.conf:

[decrypt]
filename = decrypt.py
streaming = true
# setting missing from
local = true

[ltawfall]

Yep, that totally did it. Thanks!