Getting Session key for app built using add-on builder

[ramesh_babu71]

Hello All,

We created a scripted input using Python which connects to Splunk REST API using session key which it automatically gets using below code

sessionKey = sys.stdin.readline().strip()

However when we migrated to Splunk add-on builder the above code doesn't work even with below code in inputs.conf

passAuth = admin

Currently we are able to get session key only by sending authentication request (with Splunk username and password) and then stripping the Session Key from the response we receive. However we feel this method inadequate as our distributed environment has different credentials which makes administration of such Splunk App time consuming and frustrating.

Please let us know if there methods (supported by addon builder) wherein we can get the session key without sending an auth request (Just like in normal scripted input way)

[asieira · Accepted solution]

The ideal way of interacting with the rest of Splunk when you use the add-on builder is to use the Python helper object. It allows you to save state using the KV store (which it calls check point data), for example. without resorting to acessing the REST API directly. You can also read configuration provided by the user without needing to use the Splunk REST API to read directly from configuration files.

Still, if you need to access the Splunk REST API for other purposes, take a look at its implementation on the generated add-on code under bin/<TA name>/modinput_wrapper/base_modinput.py. It seems that accessing helper.context_meta['session_key'] should work. Keep in mind, however, that this is an undocumented field that could be removed or renamed in future versions of the add-on builder.

[ramesh_babu71]

Thanks Alexandre. This worked like charm !!!

These info should have been available in Splunk AoB docs.

[starcher]

I have some of these patterns for AOB and without it here.

http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

[asieira]

Great article, thanks for sharing!