401 Unauthorized - REST API using GuzzleHttp

[sandyapps]

I am using GuzzleHttp

Login call " services/auth/login " works fine and I get the session token as well.

but after this each call give me following error

Client error: POST https://myip:8089/services/search/jobs resulted in a 401 Unauthorized response: Unauthorized

here is my code:

$host= "https://myip:8089/services/search/jobs";
$request = new \GuzzleHttp\Psr7\Request('POST', $host, [ 'headers' => ['Authorization' => 'Splunk xxxxxxxxxxxxxxxxxxxx',
                                                         'Content-Type' => 'application/x-www-form-urlencoded']]);
$response = $client->send($request, [   'verify' => false,
                                        'form_params' =>   ["search" => 'search index="asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm attack_type attack_type="*" ip_client="*" | stats count']
                                    ]);

I am running in circles and unable to figure out the problem.

[yorkshireandrew]

I found I was getting unauthorised using the 'admin' user but when I created my own with its own group giving it (admin, can_delete, power, splunk-system-role, user) privilages... I was able to get results using that... for example I created user bob then this worked.

.\curl.exe -u bob:bob -k https://127.0.0.1:8089/servicesNS/nobody/search/saved/searches

,I found I was getting unauthorised using the 'admin' user but when I created my own with its own group giving it (admin, can_delete, power, splunk-system-role, user) privilages... I was able to get results using that... for example I created user bob then this worked.

.\curl.exe -u bob:bob -k https://127.0.0.1:8089/servicesNS/nobody/search/saved/searches

[sandyapps]

Thank you for your Answer.

Actually I never found a solution for this, we had to use php SDK given by Splunk

its works like a charm 🙂