Getting Data In

How can we monitor binary log data in splunk? is invalid. Reason: binary

alexethier
Engager

I have a python script that read data from the stdin, convert the input and output human readable text to the stdout.
this is my current setup:

inputs.conf

[monitor:///var/account/pacct]
sourcetype = pacct_binary

props.conf

[pacct_binary]
invalid_cause = archive
unarchive_cmd = /opt/splunk/etc/apps/search/bin/pacct.py

I experimented with multiple configurations in inputs.conf and props.conf. No matter what I do I always get the following warning when splunk start and I don't see my sourcetype in splunk web gui.

WARN  FileClassifierManager - The file '/var/account/pacct' is invalid. Reason: binary
INFO  TailingProcessor - Ignoring file '/var/account/pacct' due to: binary

Anyone can post an exemple of a inputs.conf and props.conf that would let me load this binary file.

Best,

Alex

carmackd
Communicator

You can simply ignore the binary check as well using the following props attribute.

#******************************************************************************
# Binary file configuration
#******************************************************************************

NO_BINARY_CHECK = [true|false]
* When set to true, Splunk processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>].
* Defaults to false (binary files are ignored).
0 Karma

Ayn
Legend

Is there a reason for using monitor for this? The best option imho would be to run your pacct.py script directly as a script input and have Splunk simply read its stdout.

0 Karma

alexethier
Engager

No real reason. I'm new to Splunk. Thank you for the script input suggestion.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...