topic Re: Splunk admin credentials in scripted input in Getting Data In

Splunk admin credentials in scripted input

Erik_Swan — Sun, 12 Sep 2010 00:35:16 GMT

I remember reading somewhere i could do this but cannot find any docs on it.

I have a scripted input that wants to perform a search to find out where it last left off. To perform the search i need to auth. I remember hearing that before my script was called splunk would set the env var $USER, $PASSWORD or something. I tried dumping out env but dont see it.

Anyone figured this out or am i just dreaming of a feature.

Re: Splunk admin credentials in scripted input

gkanapathy — Sun, 12 Sep 2010 01:41:29 GMT

Perhaps what you're thinking of is that a scripted inputs and search scripts can receive an auth token. If they are set to do so (in commands.conf and inputs.conf respectively) the auth token should be passed in on stdin.

Re: Splunk admin credentials in scripted input

Erik_Swan — Sun, 12 Sep 2010 02:24:52 GMT

example somewhere?

Re: Splunk admin credentials in scripted input

Erik_Swan — Sun, 12 Sep 2010 07:58:42 GMT

answer found in docs once i knew what to look for http://www.splunk.com/base/index.php?title=Documentation:Developer:CustomSearchScripts:3.3&redirect=no

Re: Splunk admin credentials in scripted input

gkanapathy — Mon, 13 Sep 2010 00:35:44 GMT

Well, that's for a search script, not a scripted input, so it's going to be slightly different. You could probably just read the first line of stdin with with scripted and get the token that way.