Security

Using the AUTH LOGIN sessionkey with Curl SplunkAPI

admoseley
Explorer

I can successfully get a session key and capture it into a variable.. (using powershell)
What is the syntax for using the sessionkey to authenticate if I wanted to follow with a search command?

EX:
PS C:\Program Files\curl> [xml]$AuthKey = .\curl.exe -k https://splunkapi.localhost.com:8089/servicesNS/admin
/search/auth/login/ -d"username=username1" -d"password=password1"
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 118 100 80 100 38 146 69 --:--:-- --:--:-- --:--:-- 146
PS C:\Program Files\curl> $AuthKey.response.sessionKey
a72889e1846e16be2a2e0e707afcb2b6

I've looked at this but I see no specific example of the sessionkey being used.
http://dev.splunk.com/view/rest-api-overview/SP-CAAADP8

I've attempted several variations like this:
PS C:\Program Files\curl> .\curl -k https://splunkapi.localhost.com:8089/servicesNS/username/search/search/jobs -H"Authorization: Splunk $AuthKey.response.sessionKey" --data-urlencode search="|savedsearch test_saved_search"

thanks.

1 Solution

admoseley
Explorer

Finally found an example on http://stackoverflow.com/questions/3044315/how-to-set-the-authorization-header-using-curl

Turns out I was missing the space after the -H
curl -H "Authorization: OAuth " http://www.example.com

I hope this helps any new to this like I am!

View solution in original post

arahut_splunk
Splunk Employee
Splunk Employee

curl -k -u admin:changeme https://foobar:8101/services/auth/login -d username=admin -d password=changeme

2b8868fe198cf1203256e6af6515bfad

curl -k -H "Authorization: Splunk 2b8868fe198cf1203256e6af6515bfad" https://foobar:8101/services/search/jobs | less

succeeds... OUTPUT below

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>

jobs
https://foobar:8101/services/search/jobs
2014-02-11T10:13:55-08:00


Splunk

opensearch:totalResults7/opensearch:totalResults
opensearch:itemsPerPage0/opensearch:itemsPerPage
opensearch:startIndex0/opensearch:startIndex
{snipped}

admoseley
Explorer

Finally found an example on http://stackoverflow.com/questions/3044315/how-to-set-the-authorization-header-using-curl

Turns out I was missing the space after the -H
curl -H "Authorization: OAuth " http://www.example.com

I hope this helps any new to this like I am!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...