Getting Data In

Is there a way to submit events with user 'nobody' ?

davidtrujillo
Explorer

Hi.
I am trying to submit events, from a scripted input, with user 'nobody'

I am getting this error:

HTTP 403 Forbidden -- insufficient permission to access this resource

In order to submit my events I did the following:

Set tup my script in inputs.conf like this

[script://$SPLUNK_HOME/etc/apps/my_app/bin/my_script.py]
disabled = false
index = my_index
interval = * * * * *
sourcetype = generic_single_line
passAuth = nobody

As explained in the documentation, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
I am getting an auth token for my script.

passAuth = <username>
* User to run the script as.
* If you provide a username, the instance generates an auth token for that
  user and passes it to the script via stdin.

I am using the generated auth_token on my script like this.

    service = client.Service(token=auth_token, app='my_app') 
    index = service.indexes["my_index"]    
    index.submit("Test", sourcetype="my_sourcetype", host="my_host", source="my_source")

I also tried:

    kwargs = {"owner":"nobody","app":"my_app","token":auth_token}
    service = client.connect(**kwargs)  
    index = service.indexes["my_index"]    
    index.submit("Test", sourcetype="my_sourcetype", host="my_host", source="my_source")

None of them work, as soon as it reaches the line: index.submit(), it throws the HTTP 403 Forbidden error.

If I change the 'nobody' user to any other user, even a user with USER role, it works well. But I am required to make my script work with the 'nobody' one.

Any ideas on what I'm doing wrong ?

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...