Access Splunk Universal Forwarder with Splunk CLI without Login?

[peter_krammer]

What?
Is it possible to access a universal forwarder with the splunk client (/opt/splunk/bin/splunk) without supplying a username or password.

For example we would like to issue the following command:

/opt/splunk/bin/splunk display app -uri https:// SERVER :8089

I think this must somewho be possible to use the authentication token of the deployment server, because the deployment server is able to push apps out to the forwarders, so it has to have some way to access the forwarders.

Why?
We cannot easily connect to a shell on every server in our environment. Additionally if we would keep the password of the admin user on default, splunk does not allow us to connect. We don't want to set the same password on every server so we usually let the team who sets up our servers set a random password.

[Jon_Webster · Accepted solution]

Some commands require auth, and some don't. Those that do may let you use a Splunk non-admin account, which might be a good way to setup a global login that has no capabilities on the Splunk server, but let's you query the Forwarders.

"splunk display app" doesn't require authorization as far as I can tell on my system. Perhaps it's different when running remotely.

FYI: The Deployment Server does not authenticate to the Forwarders. The Forwarders connect to the Deployment Server to request updates.

[peter_krammer]

When issued to a remote server the "splunk display app" does require authentication in our system.
And as far as I know, the deploymentserver is able push out apps to the forwarder. but maybe he can just tell the forwarder it has to connect back to the deploymentserver and get its apps.