Remotely pull ./splunk diag via REST?

[oreoshake]

Is it possible to pull a diag output from the REST interface? It's slightly cumbersome, especially when I need to run more than one diag, to ssh->sudo ./splunk diag->set file perms->scp. Maybe there's a better way to do this?

Obviously these files can get pretty big, but in many cases it's only a few megs.

[rbal_splunk]

Found that it does not work on windows- but works on Unix

[pshah_splunk]

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use

curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port

[southeringtonp]

Personally, I'd rather not see this happen. I actually like the additional requirement of having server access, especially given that (one hopes) pulling Splunk diags should be a rare occurrence.

Having this added as a feature request could have some security implications, since splunk diag will contain things like raw config files. Things that would not otherwise be exposed through the application would now be accessible. For example, passwords embedded in config files or app scripts. Presumably this would be restricted to Splunk admins, but it's still a new attack point.

That doesn't necessarily implementing it it's a terrible idea, but there definitely should be an option to disable the ability (and it should not be possible to re-enable it via the GUI or REST interfaces).

[bmunson_splunk]

I see this has been implemented but I can see your concerns. I would like it to be a non default attribute like can_delete.

[jrodman]

It could be added. Diag can run whether or not splunk is running, so it's launched externally, but there's no reason we can't add launching it internally as well.

I'd been imagining a flag to diag that uploads it directly to a case, but I'm not sure if that's really what's wanted here.

[Stephen_Sorkin · Accepted solution]

Unfortunately not. splunk diag is implemented in python code called directly by the splunk binary. This is a good enhancement request to allow splunkd to invoke splunk diag on behalf of a properly authenticated admin.

[bmunson_splunk]

You can also do this from your browser with just https://server_name:port/services/streams/diag

[jatin_patel]

I am using this /services/streams/diag endpoint and its created 3GB file, it does not make sense. The usual diag creates file around 400MB. Also i cannot find any documentation on using this endpoint.

[pshah_splunk]

As of version 6.0, it is now possible for admin users or users with the get_diag capability to remotely pull diags from REST endpoint "/streams/diag". Just use

curl -k -u admin:changeme https://server_name:port/services/streams/diag >> diag_server.tar.gz"

or you can just pass a remote uri to the already existing diag command:

./splunk diag -uri remote-server-name:remote-splunk-port