Security

refresh from batch file and authenticating at the same time

Javo222
Path Finder

I'm writing a batch file that will send an http command to refresh my splunk instance. This works fine when I have already logged in with my browser once, but If I haven't logged in recently, it won't refresh and instead ask me to login.

The command sent by my batch file is

http://admin:pass@localhost:8000/en-US/debug/refresh

I always get redirected to

http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fdebug%2Frefresh

How to bypass this page?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Javo222,

take a look at this App https://apps.splunk.com/app/1871/ it was written for such use cases.
It will provide a new search command called refresh which can be called from cli or scheduled as saved search.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Javo222,

take a look at this App https://apps.splunk.com/app/1871/ it was written for such use cases.
It will provide a new search command called refresh which can be called from cli or scheduled as saved search.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Update:

there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Update available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

0 Karma

Javo222
Path Finder

Hi MuS, Thanks! I added the App to my Splunk but I'm not sure how to use it. Is there any documentation available?

0 Karma

MuS
SplunkTrust
SplunkTrust

simply enter this in the search field

| refresh

you can save it as saved search and schedule it that way or call it from the cli like this

$SPLUNK_HOME/bin/splunk search "| refresh"

hope that helps ...

Javo222
Path Finder

Ahh really good thanks! One last question hopefully, is there a way to refresh only some modules? Similar to /debug/refresh?entity=data/ui/views
It seems "| refresh?entity=data/ui/views" doesn't work

0 Karma

MuS
SplunkTrust
SplunkTrust

nope this is not implemented....maybe some day 😉

0 Karma

Javo222
Path Finder

looking forward to it! thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

please mark this as answered - thx

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...