Deployment Architecture

Backfill script doesn't pass auth parameter in Linux but works just fine in Windows

kearaspoor
SplunkTrust
SplunkTrust

I have a saved search that is currently running on a Windows search head that I have scheduled to backfill once a week. It's working just fine with with a scheduled task to launch the script:

splunk cmd python fill_summary_index.py -app search -name SUMMARY_INPUT-xxxxxxxxxxxxxx -et -1w@w0 -lt  @d -j 4 -auth xxxxxx:xxxxxxxxxxxxxxxx

I'm trying to move it onto a Linux search head because the Windows one will be decommissioned soon. I have the same search scheduled to run on the Linux search head (duplicated entries in the Summary aren't a problem in this case).

When I manually log on to the CLI for this search head and run the same backfill script:

./splunk cmd python fill_summary_index.py -app search -name SUMMARY_INPUT-xxxxxxxxxxxxxx -et -1w@w0 -lt  @d -j 4 -auth xxxxxx:xxxxxxxxxxxxxxxx

When I include the -auth xxxxxx:xxxxxxxxxxxxxxxx parameter, I get an error message saying Invalid username/password
but if I leave it out, then I'm prompted to enter the username and password and the script runs just fine.
NOTE: I'm using the same ID and password in both formats of the script.

The problem is that I need to set the script to run automatically on a schedule and since the -auth parameter doesn't get passed, the scheduled script never launches.

Thank you for your time and assistance!

1 Solution

julianje
Engager

If your password contains characters with special meaning on the unix CLI, then you might try quoting the argument: -auth 'username:passphrase'

View solution in original post

julianje
Engager

If your password contains characters with special meaning on the unix CLI, then you might try quoting the argument: -auth 'username:passphrase'

kearaspoor
SplunkTrust
SplunkTrust

This did the trick! Thank you VERY MUCH for the quick reply!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...