Getting Data In

Archive Signing

garima_chauhan
Path Finder

Hi,

I am using a script for archiving logs from colddb to a desired location. I have used the coldToFrozenExample.py script and basically just changed the archived location. The script works fine. However, since I intend to sign the bucket before archiving, I used the
signtool -s ARCHIVE_DIR
line in the script just before the bucket was to be copied to the location(as stated in the documentation). But, on doing so, the script doesnt work. Could it be the placement of signtool command? If so, please specify the exact location, as to where it should be placed. I am not familiar with python and hence, not able to spot the location.

Any help would be appreciated. Thanks in advance.

0 Karma

lguinn2
Legend

Each time the example coldToFrozen script runs, it archives a bucket by copying it. The destination directory is based on the combination of the ARCHIVE_DIR variable and the actual bucket name. To sign the bucket, you should add this line as the last line in the coldToFrozenExample.py file, keeping the same indentation as the line above it.

signtool --sign destdir

destdir is the variable containing the calculated destination path.

lguinn2
Legend

It should not go before the copy line. It should be indented exactly the same as the line before it. Also, use spaces or tabs - whichever was used in the line above.

Finally, check the ownership and permissions of the script that works. After you edit the script, does it have the same ownership and permissions? Perhaps you are changing something and that is why the script doesn't run.

0 Karma

garima_chauhan
Path Finder

I added the line signtool --sign destdir as the last line of the script and even before the copy line, but it did not work. The script doesnt run. If I remove the signtool line, it works fine. Please help

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...