Getting Data In

Splunk Add-on Builder: Global Account settings

nvonkorff
Path Finder

Hi,

Is it possible when using Global Account to customise the fields? i.e. add other fields than only Username and Password.

Ideally, I would like to be able to specify an Account Name, API Key and Authorization header in the Account tab, so that when configuring each input, I can choose the Account Name from a drop-down and have it pull the API Key and Authorization Header fields.

I can specify these as "Additional Parameters" for the add-on, but then I have no way of selecting these on a per-input basis when configuring each input.

nvonkorff_0-1634019246983.png

Labels (2)

tgombos
Engager

A bit late response, but I'm sure others would like to know the same.

I managed to make it work with a bit of customization.
In my add-on for using Azure resourcegraph endpoint i wanted the global account to have the following:

  • Client ID (Instead of Account Name)
  • Client Secret (Instead of password)
  • Tenant ID (New additional field)

How-to:

  • Navigate to /SplunkHome/etc/apps/<app-name>/appserver/static/js/build/
  • Edit your globalConfg.json
    • Add your desired custom field in the "header" under the list of "tabs". This will make your new field show in the UI after it's been added
      tgombos_0-1683617467916.png
    • Next, add your new field in the "entity" list. Unless you require a specific validator, I would just copy paste an existing field and edit it to your purpose. As shown in the image, I've altered username to Client ID and also added my Tenant ID field
      tgombos_2-1683617656366.png

       

  • Next step is to configure the handler to accept the new input field. Navigate to your app's bin folder and open <appname>_rh_account.py 
    • Add your new custom field as an object in the "fields" list. Copy paste an existing one to make it easier for you if possible
      tgombos_3-1683617878286.png
  • Finally, to update your app with your new custom inputs, you must navigate to the addon builder app. Open your list of apps, then click properties. Increment your version number. This should update your apps UI. 

Hope this helps.

 

vigneshnarendra
Explorer

How do I read which account is selected or get the username and password of the selected account?
I am not able to find any document on this.

I am only hardcoding the account name in my code.

# get_auth = helper.get_user_credential_by_id('account0')
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...