How to pass splunk UI login credentials securely to splunk server python external lookup script and then login to remote server with it?

[smitapatankarso]

splunk UI search <--> external lookup script on splunk server <--> Remote server CLI

Whenever user logs in to splunk UI and does a specific search,
the python external lookup script on splunk server should get its credentials,
these credentials should then be used to login to remote server and execute linux commands and get some data
this data is sent back to python script and then to splunk UI

[nickhills]

It seems your requirement is for Splunk to hold some credentials for a remote server, so that a query can remotely execute (over ssh) a command on the remote target?

If i have understood this, then firstly I would caution that this is a bad use case, and would very strongly advise against Splunk persisting credentials which can be used to access remote hosts.

A better solution (imo) would be to deploy a UF to each target host and have that UF run the script on a schedule to collect the same information.

Your use case may have specific reasons why you have not considered this so far, but the idea of using Splunk to manage remote ssh credentials should be avoided.