All Apps and Add-ons

How to run a Splunk search using PowerShell against Splunk Cloud that has been federated

nentwich
New Member

My company's Splunk instance is located on Splunk Cloud and authentication to Splunk Cloud is via an ADFS federation server. I have downloaded the Splunk PowerShell Resource Kit and PowerShell search cmdlets from Splunk. Using the documentation provided I am trying to connect to Splunk Cloud and run a query by running the following command:

$a = get-credential
search-splunk -Credential $a -host company.splunkcloud.com -searchstring 'search stuff'

As I do not have a Splunk Cloud account and when using the Splunk Cloud website I am redirected to my company's ADFS server first for authentication before I can interact with website. So I am not sure how to authenticate to Splunk Cloud so I can use the PowerShell cmdlets?

Any help with this would be most appreciated.

Thanks,
Joel

0 Karma

xavierashe
Contributor

have you tried this?

search-splunk -UseDefaultCredentials -host company.splunkcloud.com -searchstring 'search stuff'
0 Karma

nentwich
New Member

@xavierashe Thank you for the response but the search-splunk cmdlet that I am running does not have a -UseDefaultCredentials switch. I am running version 0.2.0 of the cmdlets. Is there a more updated version of the cmdlets that include this switch?

0 Karma

xavierashe
Contributor

Ah, I assumed that they had just extended Invoke-RestMethod. According to the github, they are no longer maintain the PowerShell Resource Kit. Take a look at this script and change

-Credential $MyCredential

to

-UseDefaultCredentials
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...