Dashboards & Visualizations

Is passAuth still supported for scripted Inputs?

Lowell
Super Champion

Anyone know if passAuth = user scripted input option is still supported in more recent version of Splunk? This is still listed in the official inputs.conf docs, and most of the blog posts or discussions about it are from many version ago (Splunk 6.x time frame). Was this dropped but not taken out of the docs?

inputs.conf:

[script://./bin/myscript.sh]
interval = 60
passAuth = splunk-system-user

myscript.sh:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
0 Karma

Lowell
Super Champion

Ah, silly bash bug!

From the Bash docs:

The exit status of read is zero unless EOF is encountered

This script works:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok || true   # Ignore non-0 exit because Splunk closes stdin (EOF) after writing the token
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...