Splunk Search

How to search Splunk API from a remote host with Forwarder installed via CLI with user and password

watkinst
Engager

If you wish to Search the API via command line (using the Splunk Binary included in the Forwarder package for example) it is executed as follows:

$SPLUNK_HOME/bin/splunk search 'yoursearch' -uri 'https://splunkAPI_Instance:8089/'

This works great on its own, however, prompts for User & Password on execution. Making scripted extraction of splunk data to export to local file called from a cron job or otherwise difficult.

My Question is, how can you execute the same and provide the username & password the way one might with CURL or WGET in the command request itself?

CURL example:

curl -k -u admin:pass https://splunkAPI_Instance:8089/services/saved/searches \
     -d name=MySavedSearch                                           \ 
     --data-urlencode search="index=_internal source=*metrics.log"

CURL outlined in Splunk Documentation References:
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTUM/RESTusing

I can't seem to find any documentation (in this REST User doc or otherwise) around passing the username & password via command line when specifically leveraging the splunk forwarder/binary. (Without also the SDK and adding Python or Ruby to the mix).

Side note: CURL & WGET are prohibited from being installed on the server where the forwarder in this scenario happens to exist, so it would be ideal to use the forwarder installation itself to perform the search since it is already there and available to local users of that (unix) system.

Once solution identified, the following should be updated to reflect the same information:
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/AboutCLIsearches
http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTTUT/RESTsearches
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTUM/RESTusing#Authentication_and_authorization

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi watkinst,

your can use the -auth switch with your remote search command:

/opt/splunkforwarder/bin/splunk search 'index=_internal' -uri 'https://someremoteip:8089' -auth admin:changeme

Just remember that you have to allow remote login on the remote Splunk instance in server.conf

allowRemoteLogin=always

read the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.3.3/Admin/AccessandusetheCLIonaremoteserver

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...