All Apps and Add-ons

How to run a Splunk search using PowerShell against Splunk Cloud that has been federated

nentwich
New Member

My company's Splunk instance is located on Splunk Cloud and authentication to Splunk Cloud is via an ADFS federation server. I have downloaded the Splunk PowerShell Resource Kit and PowerShell search cmdlets from Splunk. Using the documentation provided I am trying to connect to Splunk Cloud and run a query by running the following command:

$a = get-credential
search-splunk -Credential $a -host company.splunkcloud.com -searchstring 'search stuff'

As I do not have a Splunk Cloud account and when using the Splunk Cloud website I am redirected to my company's ADFS server first for authentication before I can interact with website. So I am not sure how to authenticate to Splunk Cloud so I can use the PowerShell cmdlets?

Any help with this would be most appreciated.

Thanks,
Joel

0 Karma

xavierashe
Contributor

have you tried this?

search-splunk -UseDefaultCredentials -host company.splunkcloud.com -searchstring 'search stuff'
0 Karma

nentwich
New Member

@xavierashe Thank you for the response but the search-splunk cmdlet that I am running does not have a -UseDefaultCredentials switch. I am running version 0.2.0 of the cmdlets. Is there a more updated version of the cmdlets that include this switch?

0 Karma

xavierashe
Contributor

Ah, I assumed that they had just extended Invoke-RestMethod. According to the github, they are no longer maintain the PowerShell Resource Kit. Take a look at this script and change

-Credential $MyCredential

to

-UseDefaultCredentials
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...