FN1315 - Cover Your Assets: Protect Your Knowledge Objects from Yourself (and Others) - A Paychex story

[sujamaskey2019]

I am trying to follow the instructions from this Splunk conf19: 

https://conf.splunk.com/watch/conf-online.html?search=FN1315#/

I am stuck where I need to update the auth token in CYA_Import_Splunk_Query 

I am using Okta with Splunk and distributed Splunk Search Heads. Any suggestions how I can get this working for the curl command to update/create the knowledge object files.

[efavreau]

@sujamaskey2019Thank you for reaching out, and for @ mentioning us. So weird that we didn't receive a notification for this question. I found it today by accident. Sorry for the late response.
We aren't familiar with Okta, but in reading up, there's some key items you'll need to discuss with your admins, regarding how you would get a token and rights to use the REST API in your environment.
For reference on what's needed token-wise, here's a link to Splunk Docs to discuss with your admin on the Splunk side of it: https://docs.splunk.com/Documentation/Splunk/Latest/Security/CreateAuthTokens

Best of luck!