Getting Data In

Why does CURL script fails to output when called by Splunk?

aweddell
New Member

Hi Guys,

I'm pulling m hair out trying to get my CURL script to run.

I've set up a scripted input in my app, it calls a bash script which has the line

curl -O -s -H "X-Requested-With: Curl Sample" -b "path=/api; secure" -u "TRUCNATED" "https://TRUNCATED&id=$id"

The script works fine when I call it normally (It dumps XML), however when I try it with
$SPLUNK_HOME/bin/splunk cmd script.sh, nothing happens.

I added an echo statement to the script and that prints normally when I execute it through cmd, however it still wont print the xml. I've tried -o -O > 1>& 2>& to files, variables, etc. It seems that when Splunk calls the script which calls CURL, output fails to work!

Any ideas would be great!

Tags (3)
0 Karma

rtllaguno
New Member

Same issue encountered when I'm trying to curl Jenkins endpoint to output the Crumb. Does anyone resolved it yet? 

curl -s -u <user|pass> "https://<url>/crumbIssuer/api/json" -o qrMerchant_jenkinsCrumb
0 Karma

jplumsdaine22
Influencer

Is $id is actually set? My guess would be that splunk is running

curl -s -H "X-Requested-With: Curl Sample" -b "path=/api; secure" -u "TRUCNATED"https://TRUNCATED&id="

which probably gives you no body.

0 Karma

stath002
Path Finder

My Curl command is different and if i manually run it as the splunk user it returns the desired results.

0 Karma

stath002
Path Finder

I am having a similar issue. However when I run $SPLUNK_HOME/splunk cmd /path/to/my_curl_script.sh I am getting the following error:

exec(): 0509-036 Cannot load program /usr/bin/curl because of the following errors:
0509-150 Dependent module /opt/splunk/splunkforwarder/lib/libz.a(libz.so.1) could not be loaded.
0509-103 The module has an invalid magic number.

0 Karma

griebn
Engager

I had the same issue getting a curl to fire. Echo out the response code of the curl command ($?) if it is returning (1) then you have an unsupported protocol and need to add to your script:

unset LD_LIBRARY_PATH

Try this, it worked for me.

aweddell
New Member

Sorry, please disregard the -O, thats not actually in there!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...