All Apps and Add-ons

Does decrypt work in distributed search environments?

ltawfall
Path Finder

I can get this app to work fine, if I'm running in locally on an indexer. But not from a distributed search head.

index=_internal | decrypt field=sourcetype hex() emit('sourcetype')

Corresponding Errors:

[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.

Works when I go to each indexer and run the command but not from the search head.

I basically looking for any app/script that will do base64 decoding from a distributed set up. Thus far I can seem to find one.

Thanks,
Lisa

0 Karma
1 Solution

bmacias84
Champion

This app is missing a setting within the commands.conf. Add the following settings to decrypt/default/commands.conf local = true. If local=true, specifies that the command should be run on the search head only. The default is false. This should fix the issue.

Example commands.conf:

[decrypt]
filename = decrypt.py
streaming = true
# setting missing from
local = true

View solution in original post

bmacias84
Champion

This app is missing a setting within the commands.conf. Add the following settings to decrypt/default/commands.conf local = true. If local=true, specifies that the command should be run on the search head only. The default is false. This should fix the issue.

Example commands.conf:

[decrypt]
filename = decrypt.py
streaming = true
# setting missing from
local = true

View solution in original post

ltawfall
Path Finder

Yep, that totally did it. Thanks!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!