Rest access to indexer from search head without password

[nhalakatti_splu]

I am trying to print the status and the hardware info for my indexers by executing the rest endpoint /services/server/info for each of the indexers on the search head by getting the indexer ip's from /services/search/distributed/peers endpoint. Given that the user has admin credentials and access, we can get the auth token to execute rest calls on search head using auth/login endpoint. Is there a way we can access the indexers from the search head without using the auth/login endpoint which requires indexer credentials input in the rest call. So basically if the username /password are different on indexers compared to the search head I need to keep taking the input credentials for each indexer to get the indexer information on the search head.

Is there a way to accomplish this without asking indexer credentials? or Is there a way as an admin I can get the credentials for accessing the indexers and then I can use the auth/login way?

Note: There is the trusted.pem that contains the public key of SH in SPLUNK_HOME/etc/auth/distServerKeys on the search that is distributed to indexers on adding the peer. But I believe this is more useful in SSH. Not sure if this can be used in a REST call to indexer

[harsmarvania57 · Accepted solution]

Yes you can achieve this but it will still require you to fetch Session Key for each Indexer first on SH. When you hit /services/search/distributed/peers REST endpoint on SH, you will get list of all Indexers and for each Indexer there is remote_session which is Session Key.

So you can use that remote_session in curl as given below

curl -k -H "Authorization: Splunk INDEXER_REMOTE_SESSION_KEY" https://<indexer_host_ip>:8089/services/server/info

[nhalakatti_splu]

Thanks @harsmarvania57 ! This does the trick!

[somesoni2]

You do this via | rest search command or using curl (or any other rest tool)?

[nhalakatti_splu]

curl like mechanism