I can get this app to work fine, if I'm running in locally on an indexer. But not from a distributed search head.
index=_internal | decrypt field=sourcetype hex() emit('sourcetype')
Corresponding Errors:
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
[xxxxx] Streamed search execute failed because: Error in 'decrypt' command: Cannot find program 'decrypt' or script 'decrypt'.
Works when I go to each indexer and run the command but not from the search head.
I basically looking for any app/script that will do base64 decoding from a distributed set up. Thus far I can seem to find one.
Thanks,
Lisa
This app is missing a setting within the commands.conf. Add the following settings to decrypt/default/commands.conf local = true. If local=true, specifies that the command should be run on the search head only. The default is false. This should fix the issue.
Example commands.conf:
[decrypt]
filename = decrypt.py
streaming = true
# setting missing from
local = true
This app is missing a setting within the commands.conf. Add the following settings to decrypt/default/commands.conf local = true. If local=true, specifies that the command should be run on the search head only. The default is false. This should fix the issue.
Example commands.conf:
[decrypt]
filename = decrypt.py
streaming = true
# setting missing from
local = true
Yep, that totally did it. Thanks!