Splunk Cloud Platform

Defining a Custom Variable to store Json Web Token when setting up APM Synthetics

splunk_user0
New Member

Hi Everyone, 

I'm trying to utilize the APM Synthetic feature to setup a recurring ping to an API to health check its availability. This API requires passing an Azure JSON Web Token (JWToken) as part of the header. To obtain the JWToken which expires in about 1 hour I need to invoke another API to go to Azure to provide me with the token value. The response to this API is coming in JSON format and I just need to retrieve one filed from this and after storing it to a Custom Variable, feed it to next API as part of the header. 

 

I've been trying to use the "Setup" Step to store the extracted filed from the json response from Azure.  The field name is "access_token" in the sample json response below.  To extract this field I've used $.access_token, which is the standard way of getting a scalar value from the json structure below. I save this value as "accessToken" and in second API call I set the header as  "Bearer {{accessToken}}". 

When I invoke the APIs set I get the error "Test validation: failed. Extract from response body failed".

{
"token_type": "Bearer",
"expires_in": 3599,
"ext_expires_in": 3599,
"access_token": "fsdfhlasdkfhsldfhsd7459438753"
}

 
Below is the "Script" view of my setup
 
[
{
"configuration": {
"name": "Token ",
"request_method": "POST",
"url": "https://apis-dev-rtfint.ace.aaaclubnet.com/dev-s-generate-identitytoken/v1/get-token-client-secret",
"headers": {
"client_id": "218365067aca423e8301421e0643781b",
"client_secret": "F052D7037b0C498A889fD19f22A140Af",
"ACCEPT": "application/json"
},
"body": "{\n \"tenant\" : \"d5f618ff-2951-8f7e-999c2dd97ab2\",\n \"client_id\" : \"836546d7-a27c-4ad2-87b1-86d94a5\",\n \"scope\" : \"api://aceclubnet.onmicrosoft.com/mulesoft/membership/.default\",\n \"grant_type\" : \"client_credentials\",\n \"client_secret\" : \"IZn8Q~rOnfaE9zCvHd7g2yoD\"\n}"
},
"setup": [
{
"name": "Extract from response body",
"type": "extract_json",
"source": "{{response.body}}",
"extractor": "$.access_token",
"variable": "accessToken"
}
],
"validations": []
},
{
"configuration": {
"name": "Request TSO Credential",
"request_method": "GET",
"url": "https://apis-dev-rtfint.aceclublab.com/dev-s-retrieve-tso-credentials/v1/retrieveTSOCredentials",
"headers": {
"client_id": "218365067aca423e8301421e0643781b",
"AUTHORIZATION": "Bearer {{accessToken}}",
"client_secret": "F052D7037b0C498A889fD19f22A140Af"
},
"body": null
},
"setup": [],
"validations": [
{
"name": "Assert response code equals 200",
"type": "assert_numeric",
"actual": "{{response.code}}",
"expected": "200",
"comparator": "equals"
}
]
}
]
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...