topic Re: Splunk Change password using inline search in #Random

Splunk Change password using inline search

jadengoho — Thu, 14 May 2020 06:51:34 GMT

How can i change password of a user, only using Inline search through Search Head ?

Search Head > Heavy Forwarder
Search Head > Indexer
Search Head > License Master
Search Head > Monitoring console
Search Head > Deployment Server

Re: Splunk Change password using inline search

livehybrid — Thu, 14 May 2020 08:55:51 GMT

You can only make GET REST requests from search bar without any additional commands.
Do you have access to the management port (8089) to do API requests?
Are you wanting to change your own password or someone else?

Re: Splunk Change password using inline search

jadengoho — Thu, 14 May 2020 09:08:02 GMT

Yeah i have access on 8089 request. im trying to update another account password.
Can it work using Rest Script ? target server [HF,IDX,MC,DS,LM]

Re: Splunk Change password using inline search

livehybrid — Thu, 14 May 2020 09:16:46 GMT

You should be able to run something like this:

curl -k -u <YOUR_USER>:<YOUR_PASS> https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD>

Or if you're using > 7,3 and using token auth you can use:

curl -k -H "Authorization: Bearer <YOUR_TOKEN>" https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD>

Re: Splunk Change password using inline search

jadengoho — Fri, 15 May 2020 03:43:48 GMT

Could i run this on a inline search ? cause if it is then this would be the answer 🙂

Re: Splunk Change password using inline search

ragedsparrow — Fri, 15 May 2020 04:31:52 GMT

You can not natively POST through the Splunk UI Search. The |rest command only supports GET requests. You could likely make your own command to do what you're wanting, or search through splunkbase/github to see if someone has already done it before.