Splunk Dev

Storing and retreiving encrypted credentials on Universal Forwarder

andrew207
Path Finder

I need to safely store encrypted credentials on a UF.

I have a scripted input that needs to call an authenticated API endpoint. The authentication is not simple, hence using a scripted input.

I have found that passwords.conf does not work on a UF, as creating the file seems to do nothing and hitting the create endpoint of the UF API returns "Method not allowed" for POST and "Not Implemented" for GET.

Given the UF binary supports the show-decrypted function I should be able to manually encrypt my password and store it that way, but there doesn't seem to be an opposite to show-encrypted to do that. hash-passwd returns a non-reversible hash.

How can I safely store encrypted credentials on a UF within the Splunk ecosystem from an app deployed by a DS?

Labels (2)
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...