Anyone know if passAuth = user scripted input option is still supported in more recent version of Splunk? This is still listed in the official inputs.conf docs, and most of the blog posts or discussions about it are from many version ago (Splunk 6.x time frame). Was this dropped but not taken out of the docs?
The exit status of read is zero unless EOF is encountered
This script works:
set -e # Strict error checking (Exit on errors)
echo "About to read token"
read -r tok || true # Ignore non-0 exit because Splunk closes stdin (EOF) after writing the token
echo "DEBUG: $tok"
# Or make whatever REST call via CURL, like so:
curl -k -H "Authorization: Splunk $tok" https://localhost:8089/servicesNS/-/-/data/inputs/script