Getting Data In

how to input encrypted files like PGP encrypted files


Hello Everyone,

Does anyone know if there is any method in Splunk to index encrypted input files like PGP encrypted files.


Labels (2)
Tags (1)

Re: how to input encrypted files like PGP encrypted files



There is no direct way of onboarding encrypted data to Splunk. In case there is a requirement to do so, you can go ahead and write a script (python/shell) that access the API of encrypted source, parse it and send it to Splunk.

There is a python library to address this


The below code should be a starter for you

import pgpy

emsg = pgpy.PGPMessage.from_file(<path to the file from the client that was encrypted using your public key>)
key,_  = pgpy.PGPKey.from_file(<path to your private key>)
with key.unlock(<your private key passpharase>):
    print (key.decrypt(emsg).message)


Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.