topic Using curl command from TA-Webtools in Splunk Search

Using curl command from TA-Webtools

jpvalenc — Fri, 12 May 2017 02:27:06 GMT

So I've been trying to use TA-Webtools app to get data from a Sharepoint site after some googling.

As a test, I’ve tried the example in the page: “| curl method=get ssl=true uri=localhost:8089/services/admin user=admin pass=changeme | table curl*”

But I’m not getting a result. I’m guessing that’s just a template and not an actual command but I’ve also tried with actual data: “| curl method=get ssl=true uri=”//_api/ProjectData/” user=”domain\user” pass=”password” | table curl*”

And I’m still not getting a result.

If it’s not too much to ask, would anyone happen to have a sample command from a public opensource website that will return results so that maybe I can reverse engineer it for my need?

Thank you so much for taking the time to read this and hope that someone out there can help.

Re: Using curl command from TA-Webtools

jkat54 — Fri, 12 May 2017 12:38:26 GMT

The current work around in version 0.03 of the app is to use a generating command prior to curl.

|makeresults count=1 | curl ...

I updated the details page of the app to reflect this but I'm also working to release v.0.04 soon which will fix this bug.

Re: Using curl command from TA-Webtools

jkat54 — Fri, 12 May 2017 16:40:14 GMT

v 0.04 has been released to address this bug.

Re: Using curl command from TA-Webtools

jpvalenc — Mon, 15 May 2017 03:14:13 GMT

I've updated and the curl command returns result now. Thank you. Just a question, does this support
NTLM authentication? I'm inputting my username/password but I'm only getting a '401 Unauthorized' in return.

Re: Using curl command from TA-Webtools

jkat54 — Mon, 15 May 2017 09:13:46 GMT

No it does not support NTLM currently.

Re: Using curl command from TA-Webtools

jkat54 — Thu, 17 Aug 2017 23:30:04 GMT

Often you can use username:password@apiserver.somedomain.com. To authenticate, it's possible that would work with this curl command and ntlm