Getting Data In

What is the format for putting information into configuration files where the data needs to be in hex/binary?

DalJeanis
Legend

Suppose that you need to define a rest where one of the fields will have a hex or binary value that you don't want to be altered by splunk.

For example, if there is a conf line in the rest stanza ...

http_header_propertys = X-Username=aUserName,X-Password=N_XyZåAbC

...which probably needs to be fed in hex so the splunk system won't get a chance to mess with that weird "aring" character.

Assuming the translation below of characters to hex was correct for the target encoding, would either of the following be the proper format? Or is there some other way? (I did notice single characters with the format 0x0c in the conf comments, but that is no guarantee that a field definition like the following would work...)

http_header_propertys = X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043
http_header_propertys = X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'
http_header_propertys = "X-Username=aUserName,X-Password=N_XyZåAbC"
http_header_propertys = "X-Username=aUserName,X-Password=0x004e005f00580079005ac3a5004100620043"
http_header_propertys = "X-Username=aUserName,X-Password=0x'004e005f00580079005ac3a5004100620043'"

I apologize if this counts as a dup.

This question is narrowly defined specifically for the purpose of giving correct sample code in the answer to this one -
https://answers.splunk.com/answers/489939/data-inputs-rest-http-header-properties-how-can-i.html#ans...

0 Karma

jlvix1
Communicator

I would imagine this, like suggested on the other Q, would be HTTP spec %XX encoding? After all this is a RESTful service and I believe the question more surrounds how the REST service interprets the data when it lands via HTTP and not how splunk handles or stores it. Certainly with a GET request (Original REST) the %XX will be supported but I'm not sure about how POST header encoding works in later REST versions that have troublesome tokens etc, possibly the same but may need a prefix? I'm unable to research this right now.

The difference between a friendly URL and un-friendly URL (GET) matters more on the HTTP server than the browser, for example, and the POST data is encoded in to the request header ?somehow?.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...