topic Re: Remotely pull ./splunk diag via REST? in Getting Data In

Remotely pull ./splunk diag via REST?

oreoshake — Tue, 04 May 2010 01:50:54 GMT

Is it possible to pull a diag output from the REST interface? It's slightly cumbersome, especially when I need to run more than one diag, to ssh->sudo ./splunk diag->set file perms->scp. Maybe there's a better way to do this?

Obviously these files can get pretty big, but in many cases it's only a few megs.

Re: Remotely pull ./splunk diag via REST?

Stephen_Sorkin — Sat, 21 Aug 2010 06:08:36 GMT

Unfortunately not. splunk diag is implemented in python code called directly by the splunk binary. This is a good enhancement request to allow splunkd to invoke splunk diag on behalf of a properly authenticated admin.

Re: Remotely pull ./splunk diag via REST?

jrodman — Sat, 04 Sep 2010 09:50:18 GMT

It could be added. Diag can run whether or not splunk is running, so it's launched externally, but there's no reason we can't add launching it internally as well.

I'd been imagining a flag to diag that uploads it directly to a case, but I'm not sure if that's really what's wanted here.

Re: Remotely pull ./splunk diag via REST?

southeringtonp — Sat, 04 Sep 2010 23:29:28 GMT

Personally, I'd rather not see this happen. I actually like the additional requirement of having server access, especially given that (one hopes) pulling Splunk diags should be a rare occurrence.

Having this added as a feature request could have some security implications, since splunk diag will contain things like raw config files. Things that would not otherwise be exposed through the application would now be accessible. For example, passwords embedded in config files or app scripts. Presumably this would be restricted to Splunk admins, but it's still a new attack point.

That doesn't necessarily implementing it it's a terrible idea, but there definitely should be an option to disable the ability (and it should not be possible to re-enable it via the GUI or REST interfaces).

Re: Remotely pull ./splunk diag via REST?

pshah_splunk — Mon, 28 Sep 2020 15:17:13 GMT

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use



curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port

Re: Remotely pull ./splunk diag via REST?

pshah_splunk — Mon, 28 Sep 2020 15:17:16 GMT

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use



curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port

Re: Remotely pull ./splunk diag via REST?

rbal_splunk — Fri, 31 Jan 2014 02:07:53 GMT

Found that it does not work on windows- but works on Unix

Re: Remotely pull ./splunk diag via REST?

bmunson_splunk — Sun, 23 Mar 2014 12:19:18 GMT

You can also do this from your browser with just https://server_name:port/services/streams/diag

Re: Remotely pull ./splunk diag via REST?

bmunson_splunk — Sun, 23 Mar 2014 12:24:23 GMT

I see this has been implemented but I can see your concerns. I would like it to be a non default attribute like can_delete.

Re: Remotely pull ./splunk diag via REST?

jatin_patel — Thu, 20 Sep 2018 18:08:52 GMT

I am using this /services/streams/diag endpoint and its created 3GB file, it does not make sense. The usual diag creates file around 400MB. Also i cannot find any documentation on using this endpoint.