Getting Data In
Highlighted

using the Resource Kit with the free license

Explorer

I'm trying to connect to Splunk via the Resource Kit and it gives me an unauthorized error.

This worked great with the Enterprise License trial, but now I can't connect even with the admin ID and password.

Invoke-HTTPPost : Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (401) Unauthorized."

What gives? I've heard from several different sources that if you have less than 500mb per day, this is a great way to track your logs. I'd like to send my logs to Splunk with the resource kit. Specifically Write-SplunkMessage cmdlet.

Is there a special way for me to connect with the free license using the Resource Kit?

Thanks in advance for your help.

Tags (1)
0 Karma
Highlighted

Re: using the Resource Kit with the free license

Splunk Employee
Splunk Employee

I don't know much about the PowerShell Resource Kit, but Splunk free does not have authentication or access control--no login. See More About Splunk Free in the Admin Manual.

0 Karma
Highlighted

Re: using the Resource Kit with the free license

Explorer

Yeah, I don't care about auth. I just want to send it logs to keep track of what my scripts are doing. I'm working around the issue now by sending syslog, but I'd like to use the Resource Kit if possible.

0 Karma
Highlighted

Re: using the Resource Kit with the free license

Splunk Employee
Splunk Employee

Copying in this info from Twitter @bsonposh (might be an exchange with you, actually, but putting it in here for others to see):

The problem is that most of the cmdlets assume authentication. Try -noauth on invoke-splunkrestapi

  • -noauth switch seems to work, but Write-SplunkMessge had auth wrapped all around it and other functions that it calls. 😞

I know… We need to fix that in the next release 😞

0 Karma
Highlighted

Re: using the Resource Kit with the free license

Explorer

ha, that was me. I'm posting the workaround in the next thread below.

0 Karma
Highlighted

Re: using the Resource Kit with the free license

Explorer

gpduck saved the day. Here are the details:

http://www.oogabooga.info/2012/10/splunk-powershell-and-free-license.html

Thanks again everybody who helped out.