All Apps and Add-ons

Why am I getting "Error in 'script': Getinfo probe failed for external search command 'base64'" using the Base64 app with Splunk 6.4.1 on Linux?

mux
Explorer
Error in 'script': Getinfo probe failed for external search command 'base64'   

I saw this link, but I don't know much about Python. https://answers.splunk.com/answers/243498/getinfo-probe-failed-for-external-search-command-a.html and I did update the libraries in /base64/bin/splunklib to the latest I found on this Splunk instance, but the command still will not execute. Any ideas?

Tags (3)
0 Karma

sloshburch
Splunk Employee
Splunk Employee

I just validated this feedback from the author of this app:

You can try this:

| stats count 
| eval str_enc = "dzAwdCwgdGhpcyBpcyBkZWNvZGVkIHN1Y2Nlc3NmdWxseSAhIQ==" 
| eval str_dec = "Hello World !!" 
| base64 field=str_enc action=decode mode=append 
| rename base64 AS str_enc_decoded 
| base64 field=str_dec action=encode mode=append 
| rename base64 AS str_dec_encoded 
| table str_enc str_enc_decoded str_dec str_dec_encoded

Basically if you see a similar output as the attached screenshot the problem should be in the data passed to the command.

I just installed it on a Splunk 6.5, no config at all on a CentOS 6.5, and it works.

So, I went ahead and validated this. In a new install of splunk, I added the app and it all worked exactly as described.

I'm still reviewing the sample you gave me to validate if this is an issue with your install (permissions or something) or the data itself. In parallel, I'd appreciate if you can let me know the results of running this command on a clean install of splunk.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Did a webex and it looks like the app that was previously downloaded might have been no good. A new download from splunkbase appears to work. Waiting to hear if things go well once change windows open up...

0 Karma

sloshburch
Splunk Employee
Splunk Employee

@mux, would you respond back with the results of this test? Notice that it doesn't require data. To get a baseline of the issue, you can use the search provided to exercise the base64 command.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...