TA-WebTools - Syntax question

[JoeCallen]

I have reviewed the curl command syntax in the details section of the Add-on download page but was not able to discern how pass the following to the "| curl" command

1) How can I pass the equivalent of:   '-k" or "--insecure'  ?

2) How do I pass 2 headers in the same command line ? 

From the LINUX prompt, my command looks like this: 

 

curl -X POST -H "Content-Type: application/json" -H "UUID: e42eed31-65bb-4283-ad05-33f18da75513" -k "https://abc.com/X1"  -d "{ lots of data }"

[splunkreal]

Hello @jkat54 noticed in splunkbase release notes "-Removed ability to specify user and pass with the command, use splunkpasswdname & splunkpasswdcontext OR token=<token> OR splunkauth=true instead."

You should update the curl commands on Details tab of splunkbase app as this is misleading.

For the moment using v3.1.2 could only make work using token not username/password. Getting error 401 when it works correctly with CLI curl command. I'm using "REST storage/passwords Manager for Splunk"

syntax: | curl method=get uri="https://xxx/internalqueries?queryguid={3A798982-3D8F-465C-BB01-9E90CE4D3B4D}&filterguid={73B09AC4-6C...}" splunkpasswdname="api.xxx" splunkauth=f

I could make it work using v3.1.0 so maybe there is a bug with latest version?

Thanks for your help and thank you for this app!

[schose]

Hi Joe,

there is a command documentation in default/searchbnf.conf

[curl-command]
syntax = CURL [choice:URI=<uri> OR URIFIELD=<urifield>] [optional: METHOD=<GET|PATCH|POST|PUT|DELETE> VERIFYSSL=<TRUE|FALSE> DATAFIELD=<field_name> DATA=<data> HEADERFIELD=<json_header_field_name> HEADERS=<json_header> USER=<user> PASS=<password> DEBUG=<true|false> SPLUNKAUTH=<true|false> SPLUNKPASSWDNAME=<username_in_passwordsconf> SPLUNKPASSWDCONTEXT=<appcontext (optional)> TIMEOUT=<float>]

-k = "VERIFYSSL=FALSE"
headers="{\"content-type\":\"application/json\"}"

best regards,

Andreas

[JoeCallen]

Andreas, thank for the quick response.  

Unfortunately, I am using Splunk Cloud, and I see in your "curl.py" file that VERIFYSSL is "Forced to be True for Splunk Cloud Compatibility".

So, while "curl -k" works from the LINUX command line on my Splunk server,  in Splunk SPL the "| curl verifyssl=false" is overridden in the add-on's python code.

Is there any way to override ??? If not, I will have to find another way to do this, as I am constrained by my environment.

[schose · Accepted solution]

Hi Joe,

yes, you can download the app, patch it and upload it as a private app.

Cheers,

Andreas