All Apps and Add-ons

Getting Session key for app built using add-on builder

ramesh_babu71
Path Finder

Hello All,

We created a scripted input using Python which connects to Splunk REST API using session key which it automatically gets using below code

sessionKey = sys.stdin.readline().strip()

However when we migrated to Splunk add-on builder the above code doesn't work even with below code in inputs.conf

passAuth = admin

Currently we are able to get session key only by sending authentication request (with Splunk username and password) and then stripping the Session Key from the response we receive. However we feel this method inadequate as our distributed environment has different credentials which makes administration of such Splunk App time consuming and frustrating.

Please let us know if there methods (supported by addon builder) wherein we can get the session key without sending an auth request (Just like in normal scripted input way)

0 Karma
1 Solution

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

View solution in original post

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

ramesh_babu71
Path Finder

Thanks Alexandre. This worked like charm !!!

These info should have been available in Splunk AoB docs.

starcher
SplunkTrust
SplunkTrust

I have some of these patterns for AOB and without it here.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

asieira
Path Finder

Great article, thanks for sharing!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...