Splunk Dev

Storing and retreiving encrypted credentials on Universal Forwarder

andrew207
Path Finder

I need to safely store encrypted credentials on a UF.

I have a scripted input that needs to call an authenticated API endpoint. The authentication is not simple, hence using a scripted input.

I have found that passwords.conf does not work on a UF, as creating the file seems to do nothing and hitting the create endpoint of the UF API returns "Method not allowed" for POST and "Not Implemented" for GET.

Given the UF binary supports the show-decrypted function I should be able to manually encrypt my password and store it that way, but there doesn't seem to be an opposite to show-encrypted to do that. hash-passwd returns a non-reversible hash.

How can I safely store encrypted credentials on a UF within the Splunk ecosystem from an app deployed by a DS?

Labels (2)
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...