Is there a way to access a service object in a custom application from the Splunk UI using JavaScript without having to create it using a specific user?

[ashishpok79]

Hi everyone,

I wanted to get a connection to Splunk service (basically an instance of splunkjs.Service) from a custom application I am deploying in Splunk. Since a user already has to log into Splunk to access the app, I was hoping to not have to use a username / password as described in the docs. Is there a way to access service object in a custom application without having to create it using a specific user as below?

var service = new splunkjs.Service({
  username:"admin",
  password:"changeme",
  scheme:"https",
  host:"localhost",
  port:"8089",
  version:"5.0"
}); 

Appreciate your input.

[martin_mueller · Accepted solution]

You can replace the username/password in the dict with the current user's sessionKey.

[martin_mueller]

I see. One fairly straight-forward way would be to create a custom controller that takes a search id and a comment, uses the splunk.entity Python module to load the search, set the comment somewhere, and save it using the same module.

[ashishpok79]

Ahh - thanks again. This actually solves probably next issue I am going to face as well (ie. how to connect search id to comment).

Awesome... thanks a lot for your insight.

[martin_mueller]

The SDKs / REST API is mainly intended for using Splunk functionality from non-Splunk applications.

What are you actually trying to achieve here?

[ashishpok79]

Right.

I have a need to get comments from users and later attach those comments in some of the scheduled reports. I can easily expose a front end to my users on a different system and create events / lookups with that data in Splunk. As I already have a custom app in Splunk, I was hoping to get this done in Splunk app itself. I already have created custom TableElement view with Custom Cell Renderers to get the input from user. I just need to send it back for persistence.

[martin_mueller]

The /splunkd/__raw/ endpoints are undocumented internal endpoints, expect changes without notice and potentially unexpected behaviour. That being said, there are POST'ing endpoints in there as well...

To get around that you can define custom controllers as python scripts in ...etc/apps/your_app/appserver/controllers that are called through host:8000/custom/your_app/... and can do stuff on the server.

[ashishpok79]

Martin, thanks again - very helpful. Let me try the controller approach. It sounds like that's the best way to do this.

I still don't understand there is no straight forward way to just use Splunk SDK / REST APIs from within a custom app.

[ashishpok79]

Hi Martin,

Upon further digging, I gotstuck with 2 issues.

1. Getting service object : As it turns out I could create a service object actually with no options passed. Like: var service = new splunkjs.Service(httpProxy, null) - client side REST calls seems to need httpProxy to get around CORS.
2. REST APIs are exposed on a different port than UI web port. I could trace some of out of box calls and noticed I could make requests by creating a proxy to /splunkd/__raw/ by creating service as in 1. However, same proxy doesn't seem to be available for POST calls (like create new event using submitEvent or it's equivalent POST method)

The only option I see at this point is to allow CORS and make AJAX calls using JQuery and Basic Authentication. This makes my app dependent on a specific account but I can't find another way.

[ashishpok79]

Perhaps a way to call REST APIs form within custom app? I see a lot of docs to use service / REST APIs from external app but can't find the best way to do "assume" currently logged user's credentials to do the same.