WebTools app - How to make the GET curl script work with Header authentication

[magesh_r]

I was testing the curl script in WebTools app in Splunk and it gives me an error. Could you let me know, what could be the issue.

The actual curl script that works is:

curl -X GET -H 'apiKey: 232040b2-22ac-11ea-978f-2e728444444' http://xxx.com/token/auth

Below is the translated one in webtool, which is not working, stating the header is not being passed correctly:

| eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce8 444444\"}"
| curl method=get http://xxx.com/token/auth headerfield=header | table curl*

Anything i am doing wrong here. Please suggest.

[magesh_r]

We are using v1.2.6, are u asking us to downgrade to 1.2.6 to try the curl again?? Please let us know.

[jkat54]

Can you try version 1.3 of the app?

We changed it so it posts JSON after that version.

[magesh_r]

We are using v1.2.6. Are you asking us to downgrade to v1.2.3 and try again the curl? Please let us know.
Advanced Thanks.

[jkat54]

Yes please try 1.2.3 which was before we made changes to add json support.

[magesh_r]

Downgraded to 1.2.3 and tried the following:

| eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce88125\"}"
| curl method=get uri=https://xxx.com/api/authorization/token headerfield=header| table curl*

Same error still with error status 400:
{"message":"Validation errors","errors":[{"code":"INVALID_REQUEST_PARAMETER","errors":[{"code":"REQUIRED","message":"Value is required but was not provided","path":["paths","/token","get","parameters"

[jkat54]

Hello again,

It looks like you have a space in your apiKey i marked it with *HERE* in example below:

 | eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce8*HERE*444444\"}"

Here is your example:

 | eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce8 444444\"}"

Which is different than what you have with your curl test.

Try this instead:

 | eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce8444444\"}"

[magesh_r]

Thanks for your response. It was a typo on my end while posting this question. Sorry about that.
There is NO space in the apiKey header anywhere in the splunk query.

[jkat54]

do you have logs from the API side that say what happened?

if you add debug=true to the | curl command... does it give the error reason and status code in the curl* fields?

[magesh_r]

Below is my curl command:
| eval header = "{\"apiKey\":\"232040b2-22ac-11ea-978f-2e728ce8444444\"}"
| curl method=get uri=http://xxx.com/token/auth headerfield=header debug=true| table curl*

I get curl stats as 400

curl message as below:

{"message":"Validation errors","errors":[{"code":"INVALID_REQUEST_PARAMETER","errors":[{"code":"REQUIRED","message":"Value is required but was not provided","path":["paths","/token","get","parameters","0"]}],"in":"header","message":"Invalid parameter (apiKey): Value is required but was not provided","name":"apiKey","path":["paths","/token","get","parameters","0"]}]}

[jkat54]

Try replacing your hyphens "-" with "%2D"

[jkat54]

| eval header = "{\"apiKey\":\"232040b2%2d22ac%2d11ea%2d978f%2d2e728ce8444444\"}"

[magesh_r]

Tried it, same status and error message.
Is my Splunk query correct for apiKey based authentication curl script?

[jkat54]

Are you using

  | makeresults count=1

At the beginning of your search?

[magesh_r]

It was not there before. Added it , same error as well. Below is my final query:

| makeresults count=1
| eval header = "{\"apiKey\":\"232040b2%2d22ac%2d11ea%2d978f%2d2e728ce88125\"}"
| curl method=get uri=http://xxx.com/token/auth headerfields=header debug=true| table curl*

[jkat54]

Try it with the dashes again instead of %2D

[magesh_r]

I tried that now and before as well. Nothing changed.
Wondering whether the header is not setup properly(may be the way i am doing is not right) , as the error is saying the apiKey value is not setup properly.
Do you have any example or reference by other members who have done this similar curl which using authentication:

Error:
{"message":"Validation errors","errors":[{"code":"INVALID_REQUEST_PARAMETER","errors":[{"code":"REQUIRED","message":"Value is required but was not provided","path":["paths","/token","get","parameters","0"]}],"in":"header","message":"Invalid parameter (apiKey): Value is required but was not provided","name":"apiKey","path":["paths","/token","get","parameters","0"]}]}

[magesh_r]

Thanks for your response. It was a typo on my behalf while posting my question. Sorry about that.
But, there is no space in the apiKey header anywhere in the Splunk query.