Getting Data In

Where does token gets stored when created by splunk UI

rishav
Explorer

Hi Everyone, 

I have enabled token based authentication and created few tokens. I can see them in UI but wanted to know where in backend it is stored. I mean which conf file.

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @rishav 

There is no doc showing where these tokens have been stored. They can only be created through web and Rest API. One of the pre-requisite is to having the kvstore enabled for tokens to work. I am guessing they might get stored there for security reasons. I have asked a question to Splunk docs feedback section hope they get back. Hope this helps!

---

An upvote would be appreciated if this reply helps!

justynap_ldz
Path Finder

Hello @venkatasri,
Have you received any feedback from the Splunk docs team?
We are also looking for the location of authorisation tokens as we need to delete one token for a non-existent user
Greetings,
Justyna

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way to try to find where it's stored it use find like this

find $SPLUNK_HOME \( -path $SPLUNK_HOME/var/log -o -path $SPLUNK_HOME/var/run/splunk/dispatch -o -path $SPLUNK_HOME/var/lib/splunk/\*/\*db\* -o -path $SPLUNK_HOME/var/lib/splunk/fishbucket \) -prune -o -type f \( -ctime -1m -o -mtime -1m \) -ls

Modify -1m what ever time you need to look, when you thing that token has created. It's told how many minutes backward it is looking when file have created or modified.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...