topic Re: Using the AUTH LOGIN sessionkey with Curl SplunkAPI in Security

Using the AUTH LOGIN sessionkey with Curl SplunkAPI

admoseley — Mon, 28 Sep 2020 11:47:44 GMT

I can successfully get a session key and capture it into a variable.. (using powershell)
What is the syntax for using the sessionkey to authenticate if I wanted to follow with a search command?

EX:
PS C:\Program Files\curl> [xml]$AuthKey = .\curl.exe -k https://splunkapi.localhost.com:8089/servicesNS/admin
/search/auth/login/ -d"username=username1" -d"password=password1"
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 118 100 80 100 38 146 69 --:--:-- --:--:-- --:--:-- 146
PS C:\Program Files\curl> $AuthKey.response.sessionKey
a72889e1846e16be2a2e0e707afcb2b6

I've looked at this but I see no specific example of the sessionkey being used.
http://dev.splunk.com/view/rest-api-overview/SP-CAAADP8

I've attempted several variations like this:
PS C:\Program Files\curl> .\curl -k https://splunkapi.localhost.com:8089/servicesNS/username/search/search/jobs -H"Authorization: Splunk $AuthKey.response.sessionKey" --data-urlencode search="|savedsearch test_saved_search"

thanks.

Re: Using the AUTH LOGIN sessionkey with Curl SplunkAPI

admoseley — Thu, 10 May 2012 20:56:21 GMT

Finally found an example on http://stackoverflow.com/questions/3044315/how-to-set-the-authorization-header-using-curl

Turns out I was missing the space after the -H
curl -H "Authorization: OAuth " http://www.example.com

I hope this helps any new to this like I am!

Re: Using the AUTH LOGIN sessionkey with Curl SplunkAPI

arahut_splunk — Tue, 11 Feb 2014 18:15:20 GMT

curl -k -u admin:changeme https://foobar:8101/services/auth/login -d username=admin -d password=changeme

2b8868fe198cf1203256e6af6515bfad

curl -k -H "Authorization: Splunk 2b8868fe198cf1203256e6af6515bfad" https://foobar:8101/services/search/jobs | less

succeeds... OUTPUT below

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0<?xml version="1.0" encoding="UTF-8"?>

<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>

jobs
https://foobar:8101/services/search/jobs
2014-02-11T10:13:55-08:00

Splunk

opensearch:totalResults7/opensearch:totalResults
opensearch:itemsPerPage0/opensearch:itemsPerPage
opensearch:startIndex0/opensearch:startIndex
{snipped}