Anyone know if passAuth = user
scripted input option is still supported in more recent version of Splunk? This is still listed in the official inputs.conf docs, and most of the blog posts or discussions about it are from many version ago (Splunk 6.x time frame). Was this dropped but not taken out of the docs?
inputs.conf:
[script://./bin/myscript.sh]
interval = 60
passAuth = splunk-system-user
myscript.sh:
#!/bin/bash
set -e # Strict error checking (Exit on errors)
echo "About to read token"
read -r tok
echo "DEBUG: $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
Ah, silly bash bug!
From the Bash docs:
The exit status of read is zero unless EOF is encountered
This script works:
#!/bin/bash
set -e # Strict error checking (Exit on errors)
echo "About to read token"
read -r tok || true # Ignore non-0 exit because Splunk closes stdin (EOF) after writing the token
echo "DEBUG: $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...