George - do you have any ideas on how to store and retrieve encrypted parameters without requiring the user to have 'admin_all_objects' capability?? ... View more

Here's how I did it: sessionKey = cherrypy.session['sessionKey'] ent = entity.getEntity('admin/alert_actions', 'email', namespace='myApp', owner='admin', sessionKey=sessionKey) ... View more

Here is how I store my SMTP_PASSWORD try: #attempt it (exception if not already there) ent=entity.getEntity("storage/passwords","SMTP_PASSWORD", namespace=self.getAppName(), owner='smartwall', sessionKey=cherrypy.session['sessionKey']) ent['password']= .... clear text password here.... ent['clear_password'] = None ent['encr_password'] = None ent['username'] = None entity.setEntity(ent) except Exception as e: #create a new one logger.info("SMTP_PASSWORD does not exist, try creating a new one") ent = entity.Entity("storage/passwords", "SMTP_PASSWORD", namespace=self.getAppName(), owner='smartwall') ent['password'] = ....clear text password here.... ent['name'] = "SMTP_PASSWORD" entity.setEntity(ent) ... View more

perhaps some capabilities are super-sets of edit_scripted? ie: if you have capability "X" then you don't need "edit_scripted". I really wish someone who has access to the splunk code would weigh in here! ... View more

I constructed a role with very few capabilities and could not use runshellscript nor have one of my alerts call a shell script. I added 'edit_scripted' to my pared down role and voila everything started working. Therefore, I'm guessing that it is a needed capability. I would love it if someone from Splunk could actually consult the code to answer this question. ... View more

the capability "edit_scripted" is required to use "runshellscript" not clear if the splunk documenation states this...but via trial and error - it is indeed a fact in v6.2.2 ... View more

It appears that the capability: edit_scripted is required to use "runshellscript" without this capability, I was getting the error described above, with the capability, it works fine. ... View more

I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable. Hence my suspicion that my user is lacking a 'capability'. ... View more

It appears that this problem arises due to the user not having the right splunk "capability". I'm not sure which capability is required but when I added the "admin" role to my user, the problem went away. I would love to know specifically which capability is required so I can make my user minimally enabled to use runshellscript.py ... View more

I have a feeling this is caused by not having the correct splunk "capability" assigned to the user. It is unclear which "capability" is needed - but I'm having this problem and when I add the role "admin" to my user, it starts working fine. ... View more

The correct way to get the sessionKey off of stdin is the following: sessionKey = urllib.unquote( sys.stdin.readline().strip()[ len("sessionKey="):] ).decode('utf8') Many thanks to George Starcher for the solution above (for versions > 6.1) SPLUNK DOC FOLKS - Neither George, nor I were able to find this tidbit from the splunk docs. ... View more

Can someone tell me what capability a user needs to have in order to execute: splunk.entity.getEntity without getting an "client not authorized/401" exception?? ... View more

Note that when I get the sessionKey within the script via: sessionKey = client.login("admin","my-admin-pw") the script runs just fine. This is what keyed me to the idea that the sessionKey I'm getting from stdin does not have admin's credentials. Is there a way to figure out what credentials a sessionKey is endowed with? ... View more

The saved search is owned by "admin" ... View more

I have tried the following WITHOUT success: sessionKey = sys.stdin.readline() sessionKey = sessionKey[len("sessionKey="):] ent = entity.getEntity('admin/alert_actions', 'email',namespace='myAppName', owner='nobody', sessionKey=sessionKey) if 'auth_username' in ent and 'clear_password' in ent: print("auth_username="+ent["auth_username"]+" clear_password="+ent["clear_password"]) else: print("entity info not found!!") ... View more

My ajax controller looks like: @expose_page(must_login=True, trim_spaces=True, methods=['GET']) def getCurrent(self, **params): where params is a dict {'type':'alert',.... } I can't seem to get access to the request ... View more

sessionKey is given to scripts (via stdin) when they are called from splunk alerts as they are fired. I still don't see how I can decrypt something like auth_password from alert_actions.conf Has anyone figured this out? ... View more

I have a django template (see below) and I'd like to embed this into a simplexml-based page... seems like something like this should be possible. {% extends "splunkdj:base_with_account_bar.html" %} {% load splunkmvc %} {% load demoview %} {% block content %} {% demo id="mydemoview" managerid="mysearch" %} {% endblock content %} {% block managers %} {% searchmanager id="mysearch" earliest_time="-3h" search="...my search here...." cache=True %} {% endblock managers %} ... View more

I can see how this algorithm works (in a depth-first-search manner). The question I have is with the my-app/local directory. The client has client-specific stuff in my-app/local such as the savedsearches.conf file in our etc/deployment-apps/my-app/local we do not have a savedsearches.conf file so I'm expecting that the client's local directory's own savedsearches.conf file won't be obliterated during a deploy. But that seems to be what is happening. By your logic, the local directory's hash will be different and if the deployment simply obliterates the local directory and copies down the new local directory...then indeed I can see how we loose our local/savedsearches.conf file. If however, the deployment overlays the my-app/local with the my-app/local that is in the etc/deployment-apps/my-app/local then we would get the behavior I am looking for where the client's savedsearches.conf file will be maintained intact. Please advise. ... View more