All Apps and Add-ons

Getting Session key for app built using add-on builder

ramesh_babu71
Path Finder

Hello All,

We created a scripted input using Python which connects to Splunk REST API using session key which it automatically gets using below code

sessionKey = sys.stdin.readline().strip()

However when we migrated to Splunk add-on builder the above code doesn't work even with below code in inputs.conf

passAuth = admin

Currently we are able to get session key only by sending authentication request (with Splunk username and password) and then stripping the Session Key from the response we receive. However we feel this method inadequate as our distributed environment has different credentials which makes administration of such Splunk App time consuming and frustrating.

Please let us know if there methods (supported by addon builder) wherein we can get the session key without sending an auth request (Just like in normal scripted input way)

0 Karma
1 Solution

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

View solution in original post

asieira
Path Finder

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

ramesh_babu71
Path Finder

Thanks Alexandre. This worked like charm !!!

These info should have been available in Splunk AoB docs.

starcher
SplunkTrust
SplunkTrust

I have some of these patterns for AOB and without it here.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

asieira
Path Finder

Great article, thanks for sharing!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...