I have a CSV file that has some data at the start of the file and in end. Like: ----BEGIN_RESPONSE_BODY_CSV "Date","Action","Module","Details","User Name","User Role","User IP" "2019-12-30T05:41:34Z","request","auth","API: active_user","xxxx","Manager","10.10.10.10" "2019-12-30T05:40:55Z","request","auth","API: active_user","xxxx","Manager","10.10.10.10" "2019-12-30T05:40:12Z","request","auth","API: active_user","xxxx","Manager","10.10.10.10" "2019-12-30T05:39:53Z","request","auth","API: active_user","xxxx","Manager","10.10.10.10" ----END_RESPONSE_BODY_CSV ----BEGIN_RESPONSE_FOOTER_CSV WARNING "CODE","TEXT","URL" "1980","10 record limit exceeded. Use URL to get next batch of results.","/api/?action=list&truncation_limit=10&id_max=1111111" ----END_RESPONSE_FOOTER_CSV I need to index the CSV data only. Need to remove the first line ----BEGIN_RESPONSE_BODY_CSV the lines between ----END_RESPONSE_BODY_CSV ----END_RESPONSE_FOOTER_CSV Please suggest what should I do in the props.conf or any conf file, to remove the unwanted data. My props.conf: [ csv ] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured description=Comma-separated value format. Set header and other settings in "Delimited Settings" disabled=false pulldown_type=true TZ=UTC TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ ... View more

Im using splunklib.client to encrypt the password as - import splunklib.client as splunk_client def save_pass(session_key ): args = {'token': session_key, 'app': "my_app"} service = splunk_client.Service(**args) for storage_password in service.storage_passwords: if storage_password.username == username and storage_password.realm == realm: return storage_password.content.clear_password Now when I making an API call the INFO logging which is logging into the my_app.log is also logged in the splunkd.log as - 05-22-2018 17:02:48.102 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/MY_APP/bin/script.py" INFO:MyAppPlatform :Making request: APIdetailsURI I'm not getting a single clue why is it happening. Please do help. ... View more

I faced a challenge and tried many things to work around for saving 2 passwords in the password.conf at the same time using the setup.xml. Is the Credential Is the Client Certificate Passphrase Setup.xml code: <setup> <block title="Credentials" endpoint="storage/passwords" entity="_new"> <text> Leave username/password blank, if you have already set it up.</text> <input field="realm"> <label>Role</label> <type>text</type> </input> <input field="name"> <label>Username</label> <type>text</type> </input> <input field="password"> <label>Password</label> <type>password</type> </input> </block> <block title="Client Certificate" endpoint="myapp/myapp_configure" entity="setupentity"> <input field="use_ca"> <label>Use a Client certificate for authentication</label> <type>bool</type> </input> <input field="ca_path"> <label>Path to client CA certificate </label> <type>text</type> </input> <input field="ca_key"> <label>Path to client CA certificate key </label> <type>text</type> </input> </block> <block title="Client Certificate Passphrase" endpoint="storage/passwords" entity="_new"> <input field="ca_pass"> <label>Passphrase for client CA certificate</label> <type>password</type> </input> </block> </setup> The Passphrase is not saved. P.S. I have created the python handler, default/myapp.conf with all the fields. The restmap.conf also has endpoint="myapp/myapp_configure". The Credentials are saved with Role/realm. ... View more