Getting Data In

Is it possible to use the oneshot command in a bash script without login prompt?

dajibade
New Member
bash-4.1# cat test_script
#!/bin/bash
sudo -H  -u splunk bash -c '/opt/splunk/bin/splunk add oneshot /opt/splunk/etc/system/local/log_dir/log_file* -index test -sourcetype test_log -auth admin:pass'

This shell script is set to a cronjob. It works perfectly for the first couple of cron schedules, then stops working. When I try to run it manually, I get a “login failed” error. I believe this is due to security features on the server don’t like the plane text password.
Is it possible to disable login & password authentication for the oneshot command so the shell script can execute? Otherwise, what other options do I have. Thanks for your help in advance.

OS – REDHAT 6
SPLUNK VERSION – 7.0.1

0 Karma

adonio
Ultra Champion

why oneshot every time? cant you monitor the file path / directories with inputs.conf?
also, looks like you are trying to check changes in your .../etc/system/local/... files to monitor changes.
there are easier ways to do so, for example: use | rest ... commands to bring the relevant results, put them in a summary index and check changes, copy the structure of folders to another place, for example: /tmp and run diff command and send output to splunk via scripted input, etc ...

hope it helps

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...