splunk to monitor password protected files

[avinashreddy539]

Hi,
I am trying to configure splunk to monitor zip files. All the files inside the zip files are password protected and hence splunk is not able to index the data from those files. Is there a way i can pass password to splunk so that it can index those password protected files. Please help. Thanks in advance.

[peter_krammer · Accepted solution]

You could define a scripted input in splunk which does the following steps:
1. look for new files in a specified directory and do per file the following steps
2. unzip file with password (unzip -P)
3. cat the content to standard output
4. remove extracted files
5. move archive to different location

With this you should be able to index the protected files in splunk.

[avinashreddy539]

Hi Peter, Thanks for the reply. Can you please provide more details? Sorry. I am new to splunk. It would be great if you share any document.

[peter_krammer]

I can only point you to how to configure scripted inputs, but you would have to write the script (unix or windows) yourself. A scripted input works by splunk executing a script and indizes any output the script generates.

How to configure inputs (generally):
http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Configureyourinputs

How to scripted input via the config files: (section "Scripted Input")
http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf

How to scripted input via the web gui:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_in_Sp...

[jrodman]

I don't believe we have support for zip 'encryption' in the splunk archive handling.

Obviously you could provide them to splunk unpacked, or repacked in non-password zip files for a limited time.