topic Re: Connecting to local Splunk instance from an app? in Splunk Dev

Connecting to local Splunk instance from an app?

guldendraak — Tue, 31 Jul 2018 14:29:36 GMT

When using the Splunk Python SDK, connecting to a Splunk instance is very easy as is described here: http://dev.splunk.com/view/python-sdk/SP-CAAAEE4

This typically uses the Splunk server address, port username and password. Is there a better way to establish a connection to the local Splunk instance from an app? The doc mentions cookies but I am unsure how to use them.

Re: Connecting to local Splunk instance from an app?

FritzWittwer_ol — Fri, 03 Aug 2018 12:43:01 GMT

Do you want to connect a Splunk App which back to the Splunk Instance, or do you have a 'standalone' app which should connect to Splunk?
Splunk knows a sessionid which has a limited lifespan and can be used to authenticate a connections.

Re: Connecting to local Splunk instance from an app?

guldendraak — Fri, 03 Aug 2018 13:02:02 GMT

The App is a custom developed app that defines a modular input (json from an API call). It would be nice - at least during development - to give the app the possibility to check on data that was already stored in splunk earlier by that same app. Currently, this is done using username and password but a more elegant way such as using a token, maybe specific to that case would be nice.

Re: Connecting to local Splunk instance from an app?

coccyx — Fri, 03 Aug 2018 15:45:15 GMT

Yes, on a single instance of Splunk, this is easy. In a distributed install, not so much. There is, as far as I am aware, no way to get an authentication token that will authorize you to a whole Splunk cluster, so you must authenticate individually to each node. On the instance you're running your modular input on however, this is supported.

If you look at the XML passed back to your modular input, there is a session token present. I'm not all that familiar with the python SDK, but it looks like maybe it's the get_scheme() method on splunklib.modularinput.Script. See:
http://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ModInputsScripts#Define_a_scheme_for_introspection
http://docs.splunk.com/Documentation/PythonSDK

The token you receive from the modular input is passed to connect as the token parameter.
http://dev.splunk.com/view/python-sdk/SP-CAAAEE4

Re: Connecting to local Splunk instance from an app?

guldendraak — Thu, 21 Mar 2019 12:10:59 GMT

That proved to be the right hint. When sub-classing splunklib.modularinput.script as is described here, one can simply use self.service for example: job = self.service.jobs.create(search) where search is an actual Splunk search.