All Apps and Add-ons

Getting Session key for app built using add-on builder

ramesh_babu71
Path Finder

Hello All,

We created a scripted input using Python which connects to Splunk REST API using session key which it automatically gets using below code

sessionKey = sys.stdin.readline().strip()

However when we migrated to Splunk add-on builder the above code doesn't work even with below code in inputs.conf

passAuth = admin

Currently we are able to get session key only by sending authentication request (with Splunk username and password) and then stripping the Session Key from the response we receive. However we feel this method inadequate as our distributed environment has different credentials which makes administration of such Splunk App time consuming and frustrating.

Please let us know if there methods (supported by addon builder) wherein we can get the session key without sending an auth request (Just like in normal scripted input way)

0 Karma
1 Solution

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

View solution in original post

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

ramesh_babu71
Path Finder

Thanks Alexandre. This worked like charm !!!

These info should have been available in Splunk AoB docs.

starcher
Influencer

I have some of these patterns for AOB and without it here.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

asieira
Path Finder

Great article, thanks for sharing!

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...