topic Re: Not able to authenticate Splunk REST API with Postman in Getting Data In

Not able to authenticate Splunk REST API with Postman

spammenot66 — Mon, 16 Jul 2018 11:02:23 GMT

I'm able to confirm this works for me curl command is working for me. It returns a session ID.
curl -k https://splunkdomain.local:8089/services/auth/login --data-urlencode username={username} --data-urlencode password={password}

Using the same end point in Postman, it complains "Login failed". Can someone please assist?

Re: Not able to authenticate Splunk REST API with Postman

niketn — Mon, 16 Jul 2018 17:39:47 GMT

@spammenot66, following is what I had tried for HEC using JSON Data packet. I had to use http on my local, however, https should work if cURL worked fine for you.

https://wiki.splunk.com/User_talk:Niketnilay#Topic_5:_HTTP_Event_Collector_.28HEC.29_in_Windows_using_cURL_with_Postman

Re: Not able to authenticate Splunk REST API with Postman

Chepech — Tue, 30 Jun 2020 21:37:00 GMT

Im stuck on the same issue, but if you look closely its not an AUTH falied, it is really a 400 Bad Request error, I'v been trying different ways to call the API on Postman but so far I haven't been able to get it working, but it works on cURL and using Requests on Python, so its definitively something related to the message formatting that is causing this.

Re: Not able to authenticate Splunk REST API with Postman

Chepech — Tue, 30 Jun 2020 22:04:55 GMT

So this is what I did to solve it... I noticed that the cURL generated by postman was not working and getting the exact same error you are seeing on the UI, this cURL command looks something like:

curl --location --request POST -k 'https://{{host}}:8089/services/auth/login' \

--data-urlencode 'username={{user}}' \

--data-urlencode 'password={{password}}'

So What I did was:

Go into Postman and click IMPORT
On the import Dialog go to the RAW Text tab and paste this:
- curl -k https://{{host}}:8089/services/auth/login --data-urlencode username={{user}} --data-urlencode password={{pass}}

And hit IMPORT, this will generate a working request. If you look at the cURL generated by it the only difference is that it actually sets the Content-Type header which seems to so the trick. It now looks something like this:

curl --location --request POST -k 'https://{{host}}:8089/services/auth/login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username={{user}}' \
--data-urlencode 'password={{pass}}'

Trying this curl command on the terminal will also work.