need to handle .ear files in splunk

[spyme72]

i want to compare the .ear file present in production with the UAT environment in splunk.
i know there is a md5 command in eval function but i need to specify a field for it.
has anyone implemented anything similar where they compare zip ,war,ear files.

[Damien_Dallimor]

The eval md5 command is for calculating a digest on a field indexed / extracted in your events.You can't pass a file path to digest the file contents.

For a quick solution , what I would try is using the Command Modular Input and utilizing a system command such as "md5sum" to periodically get a digest of your target archive files (whether they are local or remote files) and indexing the computed digest and file information. You can then run your searches over this to compare your archive files across deployment environments over time.

Of course , you could also write your own dedicated Modular Input to accomplish this task also ie: if you wanted to implement the digest algorithm programatically rather than rely on a system command.

[Damien_Dallimor]

You need to have the underlying command installed in you environment. This is mentioned in the documentation http://apps.splunk.com/app/1553/ and also on the setup screen.

[spyme72]

thanks for the response.

i am getting an exception in the configure input screen.

"Encountered the following error while trying to save: In handler 'command': Command name md5sum does not exist"

[Damien_Dallimor]

As per the documentation here , http://apps.splunk.com/app/1553/ :

1) download it
2) extract to $SPLUNK_HOME/etc/apps
3) restart Splunk
4) browse to Data Inputs manager page , as shown above.
5) configure your input , example shown above.

[spyme72]

Hi Could you please let me know on how to use the Command Modular input.
I was not able to find any details documentation on how to use it.
i found that it was a TA and i was not sure on how to reach the command screen as shown in the screen shot.