Getting Data In

splunk to monitor password protected files

avinashreddy539
New Member

Hi,
I am trying to configure splunk to monitor zip files. All the files inside the zip files are password protected and hence splunk is not able to index the data from those files. Is there a way i can pass password to splunk so that it can index those password protected files. Please help. Thanks in advance.

0 Karma
1 Solution

peter_krammer
Communicator

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

View solution in original post

peter_krammer
Communicator

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

avinashreddy539
New Member

Hi Peter, Thanks for the reply. Can you please provide more details? Sorry. I am new to splunk. It would be great if you share any document.

0 Karma

peter_krammer
Communicator

I can only point you to how to configure scripted inputs, but you would have to write the script (unix or windows) yourself. A scripted input works by splunk executing a script and indizes any output the script generates.

How to configure inputs (generally):
http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Configureyourinputs

How to scripted input via the config files: (section "Scripted Input")
http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf

How to scripted input via the web gui:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_in_Sp...

0 Karma

jrodman
Splunk Employee
Splunk Employee

I don't believe we have support for zip 'encryption' in the splunk archive handling.

Obviously you could provide them to splunk unpacked, or repacked in non-password zip files for a limited time.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...