Why does CURL script fails to output when called by Splunk?

[aweddell]

Hi Guys,

I'm pulling m hair out trying to get my CURL script to run.

I've set up a scripted input in my app, it calls a bash script which has the line

curl -O -s -H "X-Requested-With: Curl Sample" -b "path=/api; secure" -u "TRUCNATED" "https://TRUNCATED&id=$id"

The script works fine when I call it normally (It dumps XML), however when I try it with
$SPLUNK_HOME/bin/splunk cmd script.sh, nothing happens.

I added an echo statement to the script and that prints normally when I execute it through cmd, however it still wont print the xml. I've tried -o -O > 1>& 2>& to files, variables, etc. It seems that when Splunk calls the script which calls CURL, output fails to work!

Any ideas would be great!

[rtllaguno]

Same issue encountered when I'm trying to curl Jenkins endpoint to output the Crumb. Does anyone resolved it yet? 

curl -s -u <user|pass> "https://<url>/crumbIssuer/api/json" -o qrMerchant_jenkinsCrumb

[jplumsdaine22]

Is $id is actually set? My guess would be that splunk is running

curl -s -H "X-Requested-With: Curl Sample" -b "path=/api; secure" -u "TRUCNATED"https://TRUNCATED&id="

which probably gives you no body.

[stath002]

My Curl command is different and if i manually run it as the splunk user it returns the desired results.

[stath002]

I am having a similar issue. However when I run $SPLUNK_HOME/splunk cmd /path/to/my_curl_script.sh I am getting the following error:

exec(): 0509-036 Cannot load program /usr/bin/curl because of the following errors:
0509-150 Dependent module /opt/splunk/splunkforwarder/lib/libz.a(libz.so.1) could not be loaded.
0509-103 The module has an invalid magic number.

[griebn]

I had the same issue getting a curl to fire. Echo out the response code of the curl command ($?) if it is returning (1) then you have an unsupported protocol and need to add to your script:

unset LD_LIBRARY_PATH

Try this, it worked for me.

[aweddell]

Sorry, please disregard the -O, thats not actually in there!