Getting Data In

splunk to monitor password protected files

avinashreddy539
New Member

Hi,
I am trying to configure splunk to monitor zip files. All the files inside the zip files are password protected and hence splunk is not able to index the data from those files. Is there a way i can pass password to splunk so that it can index those password protected files. Please help. Thanks in advance.

0 Karma
1 Solution

peter_krammer
Communicator

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

View solution in original post

peter_krammer
Communicator

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

avinashreddy539
New Member

Hi Peter, Thanks for the reply. Can you please provide more details? Sorry. I am new to splunk. It would be great if you share any document.

0 Karma

peter_krammer
Communicator

I can only point you to how to configure scripted inputs, but you would have to write the script (unix or windows) yourself. A scripted input works by splunk executing a script and indizes any output the script generates.

How to configure inputs (generally):
http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Configureyourinputs

How to scripted input via the config files: (section "Scripted Input")
http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf

How to scripted input via the web gui:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_in_Sp...

0 Karma

jrodman
Splunk Employee
Splunk Employee

I don't believe we have support for zip 'encryption' in the splunk archive handling.

Obviously you could provide them to splunk unpacked, or repacked in non-password zip files for a limited time.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...