Getting Data In

How to make REST API call with modular data inputs for Certificate and Key based authentication?

21Sharma
New Member

I am trying to call a 3rd party API which supports Certificate and Key based authentication. I have an on-prem instance of Splunk (Version: 9.0.2) running on a VM. I have verified the API response on the VM via curl command (Command used: curl --cert <"path to .crt file"> --key <"path to .key file"> --header "Authorization: <token>" --request GET <"url">) which gives response for a normal user. However, when running the same curl command using shell in Splunk Add-on Builder's Modular Data Inputs, the command only works with "sudo" otherwise it gives Error 403. When checked with "whoami", it returns the user as root.

Question 1:

Why is the curl command not working without using sudo even when the user is root. Is there any configuration that I need to modify to make it work without using sudo.

Question 2:

How do I make the same API call using Python code in Modular Data Inputs of Splunk Add-on Builder.

Labels (1)
0 Karma

21Sharma
New Member

Thank you for your response @PickleRick. I tried running curl in verbose mode. After successful connection to proxy, I am getting below error but am unable to locate squid.conf file.

X-Squid-Error: ERR_ACCESS_DENIED 0

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Squid is not part of Splunk Enterprise installation. So if you're hitting squid it means either it is working as a reverse-proxy for your target service or you connect to it in order to perform the outbound connection.

Also - if your proxy is doing TLS inspection, cert-based mutual authentication won't work unless you create an exception in your inspection policy.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Run curl with -v to see its operation verbosely. Most probably you're trying to read cryptographic material from a directory you don't have access to.

2. In order to use client certificates you can do it like this:

https://requests.readthedocs.io/en/latest/user/advanced/#client-side-certificates

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...