Security

refresh from batch file and authenticating at the same time

Javo222
Path Finder

I'm writing a batch file that will send an http command to refresh my splunk instance. This works fine when I have already logged in with my browser once, but If I haven't logged in recently, it won't refresh and instead ask me to login.

The command sent by my batch file is

http://admin:pass@localhost:8000/en-US/debug/refresh

I always get redirected to

http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fdebug%2Frefresh

How to bypass this page?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Javo222,

take a look at this App https://apps.splunk.com/app/1871/ it was written for such use cases.
It will provide a new search command called refresh which can be called from cli or scheduled as saved search.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Javo222,

take a look at this App https://apps.splunk.com/app/1871/ it was written for such use cases.
It will provide a new search command called refresh which can be called from cli or scheduled as saved search.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Update:

there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Update available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

0 Karma

Javo222
Path Finder

Hi MuS, Thanks! I added the App to my Splunk but I'm not sure how to use it. Is there any documentation available?

0 Karma

MuS
SplunkTrust
SplunkTrust

simply enter this in the search field

| refresh

you can save it as saved search and schedule it that way or call it from the cli like this

$SPLUNK_HOME/bin/splunk search "| refresh"

hope that helps ...

Javo222
Path Finder

Ahh really good thanks! One last question hopefully, is there a way to refresh only some modules? Similar to /debug/refresh?entity=data/ui/views
It seems "| refresh?entity=data/ui/views" doesn't work

0 Karma

MuS
SplunkTrust
SplunkTrust

nope this is not implemented....maybe some day 😉

0 Karma

Javo222
Path Finder

looking forward to it! thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

please mark this as answered - thx

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...