Deployment Architecture

Backfill script doesn't pass auth parameter in Linux but works just fine in Windows

kearaspoor
SplunkTrust
SplunkTrust

I have a saved search that is currently running on a Windows search head that I have scheduled to backfill once a week. It's working just fine with with a scheduled task to launch the script:

splunk cmd python fill_summary_index.py -app search -name SUMMARY_INPUT-xxxxxxxxxxxxxx -et -1w@w0 -lt  @d -j 4 -auth xxxxxx:xxxxxxxxxxxxxxxx

I'm trying to move it onto a Linux search head because the Windows one will be decommissioned soon. I have the same search scheduled to run on the Linux search head (duplicated entries in the Summary aren't a problem in this case).

When I manually log on to the CLI for this search head and run the same backfill script:

./splunk cmd python fill_summary_index.py -app search -name SUMMARY_INPUT-xxxxxxxxxxxxxx -et -1w@w0 -lt  @d -j 4 -auth xxxxxx:xxxxxxxxxxxxxxxx

When I include the -auth xxxxxx:xxxxxxxxxxxxxxxx parameter, I get an error message saying Invalid username/password
but if I leave it out, then I'm prompted to enter the username and password and the script runs just fine.
NOTE: I'm using the same ID and password in both formats of the script.

The problem is that I need to set the script to run automatically on a schedule and since the -auth parameter doesn't get passed, the scheduled script never launches.

Thank you for your time and assistance!

1 Solution

julianje
Engager

If your password contains characters with special meaning on the unix CLI, then you might try quoting the argument: -auth 'username:passphrase'

View solution in original post

julianje
Engager

If your password contains characters with special meaning on the unix CLI, then you might try quoting the argument: -auth 'username:passphrase'

kearaspoor
SplunkTrust
SplunkTrust

This did the trick! Thank you VERY MUCH for the quick reply!

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...