Splunk Dev

How to solve security issue when using Rest API to connect to splunk?

shai
Explorer

I develop an app on a private Splunk Enterprise server and have a piece of code that accesses the rest api:

# Use Splunk REST API to get all input parameters
splunkd_uri = os.environ.get("SPLUNKD_URI", "https://127.0.0.1:8089")

endpoint = f"{splunkd_uri}/servicesNS/nobody/{app_name}/data/inputs/{app_name}"

headers = {
'Authorization': f'Splunk {session_key}'
}

response = requests.get(endpoint, headers=headers, verify=False, timeout=30)



Everything works locally but when I run app-inspect before submitting to splunkcloud I get:

FAILURE: If you are using requests.get to talk to your own infra
with non-public PKI, make sure you bundle your own CA certs as part
of your app and pass the path into requests.get as an arg. File:
bin\utils\splunk_rest.py Line Number: 19

I am trying to understand how to solve this issue, because if I put a CA that matches the server I am working on, it will not satisfy the splunkcloud server that my clients will use.

I think I am misunderstanding a core piece around how to utilize Rest API pragmatically.

What is the correct way to go about this?
Can it work both for Splunk enterprise and on Splunk Cloud?

any clue or tip may help
Thanks

Labels (4)
0 Karma

tej57
Contributor

Hello @shai,

In this scenario, you'll need to combine your certs along with SplunkCloud certificates. Just append the CA file to include self signed certificate and SplunkCloud rootCA and use the same for communication. This chain will help you communicate with both Splunk Enterprise On-Prem and SplunkCloud environment.

 

Thanks,
Tejas.

 

---

The above solution helps, an upvote is appreciated.!! 

0 Karma

shai
Explorer

Thank you for the kind reply!
Where can I find SplunkCloud rootCA ?

0 Karma

tej57
Contributor

Hello @shai,

You can find the SplunkCloud root CA from the Universal Forwarder package present on your SplunkCloud search head. It gives you a forwarder package with preconfigured outputs to forward the data to SplunkCloud indexers. Within the same app, you can find the certificates that you need to append your self signed ones with. The package name should go something like this - 100_<<stack_name>>_splunkcloud

 

Thanks,
Tejas. 

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...