Security

Using the AUTH LOGIN sessionkey with Curl SplunkAPI

admoseley
Explorer

I can successfully get a session key and capture it into a variable.. (using powershell)
What is the syntax for using the sessionkey to authenticate if I wanted to follow with a search command?

EX:
PS C:\Program Files\curl> [xml]$AuthKey = .\curl.exe -k https://splunkapi.localhost.com:8089/servicesNS/admin
/search/auth/login/ -d"username=username1" -d"password=password1"
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 118 100 80 100 38 146 69 --:--:-- --:--:-- --:--:-- 146
PS C:\Program Files\curl> $AuthKey.response.sessionKey
a72889e1846e16be2a2e0e707afcb2b6

I've looked at this but I see no specific example of the sessionkey being used.
http://dev.splunk.com/view/rest-api-overview/SP-CAAADP8

I've attempted several variations like this:
PS C:\Program Files\curl> .\curl -k https://splunkapi.localhost.com:8089/servicesNS/username/search/search/jobs -H"Authorization: Splunk $AuthKey.response.sessionKey" --data-urlencode search="|savedsearch test_saved_search"

thanks.

1 Solution

admoseley
Explorer

Finally found an example on http://stackoverflow.com/questions/3044315/how-to-set-the-authorization-header-using-curl

Turns out I was missing the space after the -H
curl -H "Authorization: OAuth " http://www.example.com

I hope this helps any new to this like I am!

View solution in original post

arahut_splunk
Splunk Employee
Splunk Employee

curl -k -u admin:changeme https://foobar:8101/services/auth/login -d username=admin -d password=changeme

2b8868fe198cf1203256e6af6515bfad

curl -k -H "Authorization: Splunk 2b8868fe198cf1203256e6af6515bfad" https://foobar:8101/services/search/jobs | less

succeeds... OUTPUT below

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>

jobs
https://foobar:8101/services/search/jobs
2014-02-11T10:13:55-08:00


Splunk

opensearch:totalResults7/opensearch:totalResults
opensearch:itemsPerPage0/opensearch:itemsPerPage
opensearch:startIndex0/opensearch:startIndex
{snipped}

admoseley
Explorer

Finally found an example on http://stackoverflow.com/questions/3044315/how-to-set-the-authorization-header-using-curl

Turns out I was missing the space after the -H
curl -H "Authorization: OAuth " http://www.example.com

I hope this helps any new to this like I am!

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...