Getting Data In

What is the format for putting information into configuration files where the data needs to be in hex/binary?

DalJeanis
SplunkTrust
SplunkTrust

Suppose that you need to define a rest where one of the fields will have a hex or binary value that you don't want to be altered by splunk.

For example, if there is a conf line in the rest stanza ...

http_header_propertys = X-Username=aUserName,X-Password=N_XyZåAbC

...which probably needs to be fed in hex so the splunk system won't get a chance to mess with that weird "aring" character.

Assuming the translation below of characters to hex was correct for the target encoding, would either of the following be the proper format? Or is there some other way? (I did notice single characters with the format 0x0c in the conf comments, but that is no guarantee that a field definition like the following would work...)

http_header_propertys = X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043
http_header_propertys = X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'
http_header_propertys = "X-Username=aUserName,X-Password=N_XyZåAbC"
http_header_propertys = "X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043"
http_header_propertys = "X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'"

I apologize if this counts as a dup.

This question is narrowly defined specifically for the purpose of giving correct sample code in the answer to this one -
https://answers.splunk.com/answers/489939/data-inputs-rest-http-header-properties-how-can-i.html#ans...

0 Karma

jlvix1
Communicator

I would imagine this, like suggested on the other Q, would be HTTP spec %XX encoding? After all this is a RESTful service and I believe the question more surrounds how the REST service interprets the data when it lands via HTTP and not how splunk handles or stores it. Certainly with a GET request (Original REST) the %XX will be supported but I'm not sure about how POST header encoding works in later REST versions that have troublesome tokens etc, possibly the same but may need a prefix? I'm unable to research this right now.

The difference between a friendly URL and un-friendly URL (GET) matters more on the HTTP server than the browser, for example, and the POST data is encoded in to the request header ?somehow?.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...