Getting Data In

Access Splunk Universal Forwarder with Splunk CLI without Login?

peter_krammer
Communicator

What?
Is it possible to access a universal forwarder with the splunk client (/opt/splunk/bin/splunk) without supplying a username or password.

For example we would like to issue the following command:

/opt/splunk/bin/splunk display app -uri https:// SERVER :8089

I think this must somewho be possible to use the authentication token of the deployment server, because the deployment server is able to push apps out to the forwarders, so it has to have some way to access the forwarders.

Why?
We cannot easily connect to a shell on every server in our environment. Additionally if we would keep the password of the admin user on default, splunk does not allow us to connect. We don't want to set the same password on every server so we usually let the team who sets up our servers set a random password.

0 Karma
1 Solution

Jon_Webster
Splunk Employee
Splunk Employee

Some commands require auth, and some don't. Those that do may let you use a Splunk non-admin account, which might be a good way to setup a global login that has no capabilities on the Splunk server, but let's you query the Forwarders.

"splunk display app" doesn't require authorization as far as I can tell on my system. Perhaps it's different when running remotely.

FYI: The Deployment Server does not authenticate to the Forwarders. The Forwarders connect to the Deployment Server to request updates.

View solution in original post

Jon_Webster
Splunk Employee
Splunk Employee

Some commands require auth, and some don't. Those that do may let you use a Splunk non-admin account, which might be a good way to setup a global login that has no capabilities on the Splunk server, but let's you query the Forwarders.

"splunk display app" doesn't require authorization as far as I can tell on my system. Perhaps it's different when running remotely.

FYI: The Deployment Server does not authenticate to the Forwarders. The Forwarders connect to the Deployment Server to request updates.

peter_krammer
Communicator

When issued to a remote server the "splunk display app" does require authentication in our system.
And as far as I know, the deploymentserver is able push out apps to the forwarder. but maybe he can just tell the forwarder it has to connect back to the deploymentserver and get its apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...