Difficulty getting -auth option recognised in query via Python subprocess.call()

[TomJordan]

Hi,
I am experiencing difficulty entering credentials via -auth on a CLI query, when invoking via Python subprocess.call()

If I run the following via terminal after restarting the Splunk daemon:

splunk search "host=sampledata-1 sourcetype=access_combined_wcookie |outputcsv flowerseller.csv" -auth admin:changeme

it does not prompt me for my credentials and the query executes.

However, if I try and run query from a Python script using subprocess.call(), Splunk ignores/doesn't get the -auth and prompts me for my credentials on stdout. Once I enter the credentials the query executes. I have tried various permutations of quotes around the -auth, but can't get it to work.

Can anyone show me what I am doing wrong? It maybe more of a Python/newbie issue but I'm hoping someone in the community has some experience of this type of scenario.

(I know that there is a REST API for authentication, but I want to use the CLI for the moment)

Thanks in advance!

T.

[TomJordan · Accepted solution]

Sorry, found out what the problem was, I was entering "-auth admin:changeme" as a single string, it should have been:

subprocess.call([path_to_splunk, "search", query, "-auth", "admin:changeme"])

[rgamoji]

Tom, thanks for the posting your observation here. It saved my day. I had been struggling with the same issue for quite some time now.