Thanks jkat54 for responding, really appreciate your time.
The scenario is slightly different in that this is a modular input that gets distributed as an app from Splunk Base. The script that is the modular input doesnt know about any locally provisioned credentials and needs to rely on what was passed to it at the point is was invoked by splunkd.
When splunkd invokes a modular input is provides via STDIN configuration items, one of which is .
If I try an use the provided value as an authentication token to perform any REST action it fails with an authorization warning. Just for testing, if I authenticate with a locally provisioned user, capture the session token and use this token to perform the same REST action it works.
If anyone has any experience of using the splunkd provided to perform actions that would be great.
... View more