Getting Data In

What is the format for putting information into configuration files where the data needs to be in hex/binary?

DalJeanis
Legend

Suppose that you need to define a rest where one of the fields will have a hex or binary value that you don't want to be altered by splunk.

For example, if there is a conf line in the rest stanza ...

http_header_propertys = X-Username=aUserName,X-Password=N_XyZåAbC

...which probably needs to be fed in hex so the splunk system won't get a chance to mess with that weird "aring" character.

Assuming the translation below of characters to hex was correct for the target encoding, would either of the following be the proper format? Or is there some other way? (I did notice single characters with the format 0x0c in the conf comments, but that is no guarantee that a field definition like the following would work...)

http_header_propertys = X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043
http_header_propertys = X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'
http_header_propertys = "X-Username=aUserName,X-Password=N_XyZåAbC"
http_header_propertys = "X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043"
http_header_propertys = "X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'"

I apologize if this counts as a dup.

This question is narrowly defined specifically for the purpose of giving correct sample code in the answer to this one -
https://answers.splunk.com/answers/489939/data-inputs-rest-http-header-properties-how-can-i.html#ans...

0 Karma

jlvix1
Communicator

I would imagine this, like suggested on the other Q, would be HTTP spec %XX encoding? After all this is a RESTful service and I believe the question more surrounds how the REST service interprets the data when it lands via HTTP and not how splunk handles or stores it. Certainly with a GET request (Original REST) the %XX will be supported but I'm not sure about how POST header encoding works in later REST versions that have troublesome tokens etc, possibly the same but may need a prefix? I'm unable to research this right now.

The difference between a friendly URL and un-friendly URL (GET) matters more on the HTTP server than the browser, for example, and the POST data is encoded in to the request header ?somehow?.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...