Getting Data In

What is the format for putting information into configuration files where the data needs to be in hex/binary?

DalJeanis
Legend

Suppose that you need to define a rest where one of the fields will have a hex or binary value that you don't want to be altered by splunk.

For example, if there is a conf line in the rest stanza ...

http_header_propertys = X-Username=aUserName,X-Password=N_XyZåAbC

...which probably needs to be fed in hex so the splunk system won't get a chance to mess with that weird "aring" character.

Assuming the translation below of characters to hex was correct for the target encoding, would either of the following be the proper format? Or is there some other way? (I did notice single characters with the format 0x0c in the conf comments, but that is no guarantee that a field definition like the following would work...)

http_header_propertys = X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043
http_header_propertys = X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'
http_header_propertys = "X-Username=aUserName,X-Password=N_XyZåAbC"
http_header_propertys = "X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043"
http_header_propertys = "X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'"

I apologize if this counts as a dup.

This question is narrowly defined specifically for the purpose of giving correct sample code in the answer to this one -
https://answers.splunk.com/answers/489939/data-inputs-rest-http-header-properties-how-can-i.html#ans...

0 Karma

jlvix1
Communicator

I would imagine this, like suggested on the other Q, would be HTTP spec %XX encoding? After all this is a RESTful service and I believe the question more surrounds how the REST service interprets the data when it lands via HTTP and not how splunk handles or stores it. Certainly with a GET request (Original REST) the %XX will be supported but I'm not sure about how POST header encoding works in later REST versions that have troublesome tokens etc, possibly the same but may need a prefix? I'm unable to research this right now.

The difference between a friendly URL and un-friendly URL (GET) matters more on the HTTP server than the browser, for example, and the POST data is encoded in to the request header ?somehow?.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...