Splunk Dev

How to pass credentials within custom search command using Python SDK 1.5

elekanne
Explorer

I'm building a custom search command (in Python with the SDK 1.5). From within the script (search command), I need to connect to the Splunk instance to execute some extra searches and retrieve some kv collections.

To have a service object to Splunk I use:

service = client.connect( username=, password=, app=)

But I do not want to have the username and password part of this script. I have tried "passauth" from the commands.conf, but I do not seem to get a token or session.

Is there a way to pass credentials to this type of script?

0 Karma
1 Solution

elekanne
Explorer

I found the answer. If i do:

logger.debug("session token key is: %s", self._metadata.searchinfo.session_key)
service = client.connect( token=self._metadata.searchinfo.session_key)
for app in service.apps:
    logger.debug("apps: %s", app['name'])

Then the session token is retrieved. The generating command derives from a search command which has this information.
The same applies for getting the version of splunk you're running which is self._metadata.searchinfo.splunk_version

View solution in original post

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...