Dashboards & Visualizations

Is passAuth still supported for scripted Inputs?

Lowell
Super Champion

Anyone know if passAuth = user scripted input option is still supported in more recent version of Splunk? This is still listed in the official inputs.conf docs, and most of the blog posts or discussions about it are from many version ago (Splunk 6.x time frame). Was this dropped but not taken out of the docs?

inputs.conf:

[script://./bin/myscript.sh]
interval = 60
passAuth = splunk-system-user

myscript.sh:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
0 Karma

Lowell
Super Champion

Ah, silly bash bug!

From the Bash docs:

The exit status of read is zero unless EOF is encountered

This script works:

#!/bin/bash
set -e           #  Strict error checking (Exit on errors)
echo "About to read token"
read -r tok || true   # Ignore non-0 exit because Splunk closes stdin (EOF) after writing the token
echo "DEBUG:  $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script
...
Get Updates on the Splunk Community!

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...

Splunk SOAR Now Available on Google Cloud Platform

We’re excited to announce that Splunk SOAR is now natively available as a SaaS solution on Google Cloud ...