Security

Why am I getting an authentication error trying to add oneshot via CLI from a remote computer?

Javo222
Path Finder

Trying to run a batch file to add a log file to splunk. Works fine if I run it locally but not from a remote computer.

This is the line I'm having trouble with:

\\172.25.30.30\Splunk\bin\splunk.exe" add oneshot "\\172.25.30.30\shared\splunk\reports\name\Server.log"

I tried to add:

-hostname localhost.localdomain

or:

  -auth admin:pass

But I still get the same error:

In handler 'oneshotinput': unable to open file: path='\\172.25.30.30\shared\splunk\reports\name\Server.log' error='Logon failure: unknown user name or bad password.'

admin and pass are the correct credentials to Splunk.
Anything I am missing?

0 Karma
1 Solution

MuS
Legend

Hi Javo222,

I just learned that the add oneshot is run locally on the Splunk instance you're running it. This means this should be listed in the docs as well as not supported remote command.

@piebob and @ppablo_splunk could you please verify this and have the docs updated? Thanks 🙂

cheers, MuS

View solution in original post

MuS
Legend

Hi Javo222,

I just learned that the add oneshot is run locally on the Splunk instance you're running it. This means this should be listed in the docs as well as not supported remote command.

@piebob and @ppablo_splunk could you please verify this and have the docs updated? Thanks 🙂

cheers, MuS

piebob
Splunk Employee
Splunk Employee

just passed this on to our world class docteam! thank you, oh mighty SPAMHAMMER @MuS !

Javo222
Path Finder

ahah at least now I know why it didn't work! thanks guys!

ChrisG
Splunk Employee
Splunk Employee

Docs are updated to mention this restriction!

musskopf
Builder

Have you tried to use the default: "admin:changeme"?

0 Karma

MuS
Legend

normally you should uses the -uri https://splunkserver:8089 option if you want to use a remote cli command. See docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/AccessandusetheCLIonaremoteserver also did you enable remote access in server.conf on the remote server?

0 Karma

Javo222
Path Finder

I enabled remote access and changed to:

"C:\Program Files\Splunk\bin\splunk.exe" add oneshot "C:\Users\myuser\Documents\splunk_data\reports\name\Server.log" -uri http://172.25.30.30:8000

and I get "Not found" but I can't figure out what is not found. The path the the files is correct and tried to use remote path as well but no luck.

0 Karma

MuS
Legend

I'll check that tomorrow morning ....

0 Karma

Javo222
Path Finder

I found another way to do it. copied the files to the remote server and use monitoring the folder. So I don't need the oneshot add anymore.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...