Getting Data In

Remotely pull ./splunk diag via REST?

Communicator

Is it possible to pull a diag output from the REST interface? It's slightly cumbersome, especially when I need to run more than one diag, to ssh->sudo ./splunk diag->set file perms->scp. Maybe there's a better way to do this?

Obviously these files can get pretty big, but in many cases it's only a few megs.

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

Unfortunately not. splunk diag is implemented in python code called directly by the splunk binary. This is a good enhancement request to allow splunkd to invoke splunk diag on behalf of a properly authenticated admin.

View solution in original post

Splunk Employee
Splunk Employee

Found that it does not work on windows- but works on Unix

0 Karma

Splunk Employee
Splunk Employee

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use


curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port

Motivator

Personally, I'd rather not see this happen. I actually like the additional requirement of having server access, especially given that (one hopes) pulling Splunk diags should be a rare occurrence.

Having this added as a feature request could have some security implications, since splunk diag will contain things like raw config files. Things that would not otherwise be exposed through the application would now be accessible. For example, passwords embedded in config files or app scripts. Presumably this would be restricted to Splunk admins, but it's still a new attack point.

That doesn't necessarily implementing it it's a terrible idea, but there definitely should be an option to disable the ability (and it should not be possible to re-enable it via the GUI or REST interfaces).

Splunk Employee
Splunk Employee

I see this has been implemented but I can see your concerns. I would like it to be a non default attribute like can_delete.

0 Karma

Splunk Employee
Splunk Employee

It could be added. Diag can run whether or not splunk is running, so it's launched externally, but there's no reason we can't add launching it internally as well.

I'd been imagining a flag to diag that uploads it directly to a case, but I'm not sure if that's really what's wanted here.

Splunk Employee
Splunk Employee

Unfortunately not. splunk diag is implemented in python code called directly by the splunk binary. This is a good enhancement request to allow splunkd to invoke splunk diag on behalf of a properly authenticated admin.

View solution in original post

Splunk Employee
Splunk Employee

You can also do this from your browser with just https://server_name:port/services/streams/diag

0 Karma

Path Finder

I am using this /services/streams/diag endpoint and its created 3GB file, it does not make sense. The usual diag creates file around 400MB. Also i cannot find any documentation on using this endpoint.

0 Karma

Splunk Employee
Splunk Employee

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use


curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!