Getting Data In

Archive Signing

garima_chauhan
Path Finder

Hi,

I am using a script for archiving logs from colddb to a desired location. I have used the coldToFrozenExample.py script and basically just changed the archived location. The script works fine. However, since I intend to sign the bucket before archiving, I used the
signtool -s ARCHIVE_DIR
line in the script just before the bucket was to be copied to the location(as stated in the documentation). But, on doing so, the script doesnt work. Could it be the placement of signtool command? If so, please specify the exact location, as to where it should be placed. I am not familiar with python and hence, not able to spot the location.

Any help would be appreciated. Thanks in advance.

0 Karma

lguinn2
Legend

Each time the example coldToFrozen script runs, it archives a bucket by copying it. The destination directory is based on the combination of the ARCHIVE_DIR variable and the actual bucket name. To sign the bucket, you should add this line as the last line in the coldToFrozenExample.py file, keeping the same indentation as the line above it.

signtool --sign destdir

destdir is the variable containing the calculated destination path.

lguinn2
Legend

It should not go before the copy line. It should be indented exactly the same as the line before it. Also, use spaces or tabs - whichever was used in the line above.

Finally, check the ownership and permissions of the script that works. After you edit the script, does it have the same ownership and permissions? Perhaps you are changing something and that is why the script doesn't run.

0 Karma

garima_chauhan
Path Finder

I added the line signtool --sign destdir as the last line of the script and even before the copy line, but it did not work. The script doesnt run. If I remove the signtool line, it works fine. Please help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...