Dashboards & Visualizations

Is passAuth still supported for scripted Inputs?

Lowell
Super Champion

Anyone know if passAuth = user scripted input option is still supported in more recent version of Splunk? This is still listed in the official inputs.conf docs, and most of the blog posts or discussions about it are from many version ago (Splunk 6.x time frame). Was this dropped but not taken out of the docs?

inputs.conf:

[script://./bin/myscript.sh]
interval = 60
passAuth = splunk-system-user

myscript.sh:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
0 Karma

Lowell
Super Champion

Ah, silly bash bug!

From the Bash docs:

The exit status of read is zero unless EOF is encountered

This script works:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok || true   # Ignore non-0 exit because Splunk closes stdin (EOF) after writing the token
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...