Splunk Change password using inline search

[jadengoho]

How can i change password of a user, only using Inline search through Search Head ?

Search Head > Heavy Forwarder
Search Head > Indexer
Search Head > License Master
Search Head > Monitoring console
Search Head > Deployment Server

[ragedsparrow]

You can not natively POST through the Splunk UI Search. The |rest command only supports GET requests. You could likely make your own command to do what you're wanting, or search through splunkbase/github to see if someone has already done it before.

[livehybrid]

You should be able to run something like this:

curl -k -u <YOUR_USER>:<YOUR_PASS> https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD>

Or if you're using > 7,3 and using token auth you can use:

curl -k -H "Authorization: Bearer <YOUR_TOKEN>" https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD>

[jadengoho]

Could i run this on a inline search ? cause if it is then this would be the answer 🙂

[livehybrid]

You can only make GET REST requests from search bar without any additional commands.
Do you have access to the management port (8089) to do API requests?
Are you wanting to change your own password or someone else?

[jadengoho]

Yeah i have access on 8089 request. im trying to update another account password.
Can it work using Rest Script ? target server [HF,IDX,MC,DS,LM]