Splunk Search

Constructing URL to add a splunk user via REST (or via ansible uri mod)

brent_weaver
Builder

So I need to add a bunch of local users to Splunk. We are an ansible shop, and we can leverage the uri modue:

---

- name: Add Splunk Users
  uri:
    url: https://localhost:8089/services/authentication/users
    method: POST
    validate_certs: no
    user: admin
    password: jonesville
    body: '{ name: "brent", password: "jonesville", roles: "admin" }'
    force_basic_auth: yes

This does not work. How can I construct the body to take my input and add the user as necessary? I could also maybe string a whole url together and POST?!?!

Any advice is MUCH appreciated.

Tags (1)
0 Karma
1 Solution

brent_weaver
Builder

Hey guys. I got it!

So i have an ansible playbook as such:

---
- name: Add Splunk Users via REST API
  uri:
    url: https://localhost:8089/services/authentication/users
    method: POST
    validate_certs: no
    user: "{{ splunk_admin_user }}"
    password: "{{ splunk_admin_pass }}"
    body: "realname={{ item.comment }}&name={{ item.username }}&password={{ item.splunk_pass }}&roles=admin&email={{ item.email }}"
    force_basic_auth: yes
    status_code: 201,400
    headers:
      Content-Type: "application/x-www-form-urlencoded"
  with_items:
    - "{{ users }}"

Create an ansible dictionary variable:

---
users:
  - { username: "123456789", splunk_pass: "bobsuncle", email: "new.user@domain.com", comment: "User, New" }

Call that file at invocation of the playbook with -e @varfile.yml.

This may seem like overkill but this allows me to manage outlier accounts on hundreds of servers, ansible style. I like doing it this way because the uri module is very flex and alows you to capture allot about the event, most namely to accept certain https exit codes as "OK".

Hopefully this helps someone else out.

View solution in original post

brent_weaver
Builder

Hey guys. I got it!

So i have an ansible playbook as such:

---
- name: Add Splunk Users via REST API
  uri:
    url: https://localhost:8089/services/authentication/users
    method: POST
    validate_certs: no
    user: "{{ splunk_admin_user }}"
    password: "{{ splunk_admin_pass }}"
    body: "realname={{ item.comment }}&name={{ item.username }}&password={{ item.splunk_pass }}&roles=admin&email={{ item.email }}"
    force_basic_auth: yes
    status_code: 201,400
    headers:
      Content-Type: "application/x-www-form-urlencoded"
  with_items:
    - "{{ users }}"

Create an ansible dictionary variable:

---
users:
  - { username: "123456789", splunk_pass: "bobsuncle", email: "new.user@domain.com", comment: "User, New" }

Call that file at invocation of the playbook with -e @varfile.yml.

This may seem like overkill but this allows me to manage outlier accounts on hundreds of servers, ansible style. I like doing it this way because the uri module is very flex and alows you to capture allot about the event, most namely to accept certain https exit codes as "OK".

Hopefully this helps someone else out.

mattymo
Splunk Employee
Splunk Employee
0 Karma

jkat54
SplunkTrust
SplunkTrust

Which version of Splunk? 7.x introduced a new process that involves a seed file.

0 Karma

brent_weaver
Builder

This is 7.2, but this is post install, i got the seed part down (and thats a nice feature)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...