Refine your search:

I am trying to create a scripted input that can run some Splunk CLI commands. Using passAuth in inputs.conf I was able to pass in (and read from stdin) an auth token. But I can't find how to successfully take that token and pass it back in on a CLI command line. I tried -auth <token> and got a "Login failed". Any idea what CLI argument (if any) allows me to authenticate from an auth token directly?

Related question at http://splunk-base.splunk.com/answers/6707/splunk-admin-credentials-in-scripted-input.

asked 12 May '11, 20:11

dwaddle's gravatar image

dwaddle ♦
11.2k1516
accept rate: 34%

edited 13 May '11, 09:15

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215


One Answer:

There isn't a CLI argument to do that. You would likely be better served by going through the REST API if possible.

When you run a splunk CLI search, it will look in ~/.splunk for an existing authToken, and prompts you for credentials if a valid authToken is not found. Typically that file is written when you run splunk login.

There's nothing to prevent you from writing that file out yourself before calling the CLI, but give careful consideration to the implications of doing so. First, any user who could read that directory could use those credentials (which is already true). Second, if you also run CLI commands directly as root (or splunk's service account), either the interactive user or the scripted input could get the wrong credentials.

If you absolutely must call CLI commands directly, there's a workaround. Use mktemp to create a temporary directory, and make sure the permissions are restricted. Write the authToken to $TMPDIR/.splunk/authToken_<hostname>_<portnum>. Then, set the $HOME environment variable to your $TMPDIR before calling the CLI command(s). Once you're done, delete the authToken and the temporary directory.

link

answered 13 May '11, 09:14

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215
accept rate: 35%

edited 13 May '11, 09:18

Yup, making your own authToken file works. The caveats still apply, but it got me around my specific issue here.

(13 May '11, 11:42) dwaddle ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×89
×82
×2

Asked: 12 May '11, 20:11

Seen: 692 times

Last updated: 13 May '11, 11:42

Copyright © 2005-2012 Splunk, Inc. All rights reserved.