topic Re: How to execute searches with auth token, using the Webtools Add-on in Getting Data In

How to execute searches with auth token, using the Webtools Add-on

splunker686 — Tue, 05 Oct 2021 18:29:12 GMT

Hi @jkat54, thank you for creating this wonderful app. I have a use case that requires executing remote searches from one independent search head to another search head, with the use of auth tokens.

I am able to do so using the linux curl command, using the following command syntax:

curl -k -H "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTIiLCJ2ZXIiOiJ2MiIsInR0eXAiOiJzdGF0aWMifQ.eyJpc" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal | head 10"

I would like to know how I can translate the above syntax into search command, leveraging the webtools add-on. Thanks in advance for your help.

Re: How to execute searches with auth token, using the Webtools Add-on

jkat54 — Tue, 05 Oct 2021 18:34:58 GMT

Did you see the examples on the splunkbase details tab?

the one below matches what you're doing:

Setting a Custom Header & Test Data:
| makeresults count=1
| eval header="{\"content-type\":\"application/json\"}"
| eval data="{\"test data\":\"DATA\"}"
| curl method=post uri=https://localhost:8089/services user=admin pass=changeme debug=true headerfield=header datafield=data

Re: How to execute searches with auth token, using the Webtools Add-on

splunker686 — Tue, 05 Oct 2021 19:39:56 GMT

Thank you @jkat54 for your tip. This seems to work as expected now:

| makeresults count=1 | eval header="{\"content-type\":\"application/json\",\"Authorization\":\"Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTIiLCJ2ZXIiOiJ2MiIsInR0eXAiOiJzdGF0aWMifQ.eyJpc...\"}" | eval data="{\"search\":\"search index=_internal source=*splunkd.log | head 10 | table _raw\",\"output_mode\":\"csv\"}" | curl method=get uri=https://localhost:8089/services/search/jobs/export headerfield=header datafield=data

Thanks again for this useful tool. Please keep up the good work. 🙏

Re: How to execute searches with auth token, using the Webtools Add-on

jkat54 — Tue, 05 Oct 2021 20:19:22 GMT

Great! Thanks for accepting my answer and smashing the thumbs up button!

Happy POWER splunking!

Re: How to execute searches with auth token, using the Webtools Add-on

jkat54 — Tue, 05 Oct 2021 20:21:18 GMT

Make sure you rotate auth tokens for that account or restart splunk on that host. You have the whole token shown in the image.