Splunk Dev

How to pass splunk UI login credentials securely to splunk server python external lookup script and then login to remote server with it?

smitapatankarso
Explorer

splunk UI search <--> external lookup script on splunk server <--> Remote server CLI

Whenever user logs in to splunk UI and does a specific search,
the python external lookup script on splunk server should get its credentials,
these credentials should then be used to login to remote server and execute linux commands and get some data
this data is sent back to python script and then to splunk UI

Labels (1)
0 Karma

nickhills
Ultra Champion

It seems your requirement is for Splunk to hold some credentials for a remote server, so that a query can remotely execute (over ssh) a command on the remote target?

If i have understood this, then firstly I would caution that this is a bad use case, and would very strongly advise against Splunk persisting credentials which can be used to access remote hosts.

A better solution (imo) would be to deploy a UF to each target host and have that UF run the script on a schedule to collect the same information.

Your use case may have specific reasons why you have not considered this so far, but the idea of using Splunk to manage remote ssh credentials should be avoided.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...