Currently using Splunk 6.2.3
I have a python script that is being executed as part of a Custom Alert Action. This script retrieves credentials (for our internal tickets system) that are stored in a Splunk App I set up.
I have been following this blog post for the setup of my script: https://www.splunk.com/blog/2011/03/15/storing-encrypted-credentials.html
NOTE: I chose to have it send me an email with the error message instead of having to go check a log file, so the sendErrorEmail is something I defined.
However, when my script runs, i keep getting the error: "Could not get My_App credentials from splunk. Error: [HTTP 401] Client is not authenticated"
Below is my script code. Any idea what I'm doing wrong or if there is something I'm missing?
def getCredentials(sessionKey):
myapp = 'My_App'
#Trims off "sessionKey=" from readline
#Even if I remove this line, my script doesn't work
sessionKey = sessionKey[11:]
try:
# list all credentials
entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=sessionKey)
except Exception, e:
html = "sessionKey == " + sessionKey + "
<br/>Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)) text = "Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)) sendErrorEmail(html, text); raise Exception("Could not get %s credentials from splunk. Error: %s" % (myapp, str(e))) # return first set of credentials for i, c in entities.items(): return c['username'], c['clear_password'] html = "No credentials have been found" text = "No credentials have been found" sendErrorEmail(html, text); raise Exception("No credentials have been found") def main(): sessionKey = sys.stdin.readline().strip() if sessionKey == "": html = 'No sessionKey' text = 'No sessionKey' sendErrorEmail(html, text) username, password = getCredentials(sessionKey) credentials = [username, password]
<br/>Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)) text = "Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)) sendErrorEmail(html, text); raise Exception("Could not get %s credentials from splunk. Error: %s" % (myapp, str(e))) # return first set of credentials for i, c in entities.items(): return c['username'], c['clear_password'] html = "No credentials have been found" text = "No credentials have been found" sendErrorEmail(html, text); raise Exception("No credentials have been found") def main(): sessionKey = sys.stdin.readline().strip() if sessionKey == "": html = 'No sessionKey' text = 'No sessionKey' sendErrorEmail(html, text) username, password = getCredentials(sessionKey) credentials = [username, password]