Monitoring Splunk

How can I disable splunk auth for the command-line

katzj
Engager

I have a regularly scheduled job which generates a log-file which I then use my local splunk light-forwarder to send to a remote splunk instance with splunk add oneshot $LOG_FILE -sourcetype $SOURCE

This ends up requiring authentication. I know that I could hard-code a "-auth user:pass" argument into the script as well, but I'd prefer to not do that and instead be able to just disable authentication on the local host for splunk cli access. Is there a way to do this?

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Just dump the file in a batch directory such as $SPLUNK_HOME/var/spool/splunk. This does not require authentication, and you can control the sourcetype, source, etc with dynamic metadata assignment:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Assignmetadatatoeventsdynamically

View solution in original post

araitz
Splunk Employee
Splunk Employee

Just dump the file in a batch directory such as $SPLUNK_HOME/var/spool/splunk. This does not require authentication, and you can control the sourcetype, source, etc with dynamic metadata assignment:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Assignmetadatatoeventsdynamically

maraman_splunk
Splunk Employee
Splunk Employee
0 Karma

thartmann
Path Finder

I actually think this would be useful as well, something like kerberos's kadmin.local binary.

0 Karma

Genti
Splunk Employee
Splunk Employee

I do not think you can disable authentication. You have two options that i can think of:

  • `./splunk login` before you run the script
  • use:
    `export SPLUNK_USERNAME=admin`
    `export SPLUNK_PASSWORD=changeme`

cheers!
.gz

eddiet
Explorer

i couldn't find this, where is this documented?

0 Karma

eddiet
Explorer

where is this username/password envvar documented?

dmahler99
Explorer

the export of the user password into environment variables worked great... thanks

0 Karma

charleswheelus
Path Finder

This approach is just what I was looking for. Thanks!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>