HTTP FORM POST to Splunk API

[mtutty]

I'm trying to integrate with Splunk by using Jitterbit. Splunk offers a REST API for this purpose, but I'm having trouble with the authentication method and need some help formatting or troubleshooting the data being sent.

I can post a form like this:

Code: Select all

<form method="POST" action="https://splunkurl/api/services/auth/login">
User ID: <input type="text" name="username" /><br />
Password: <input type="password" name="password" /><br />
<input type="submit" name="submit" value="Submit" />
</form>


and get back this response:

Code: Select all

<response>
<sessionKey>375f22c54af0f2b570def012e6a9d530</sessionKey>
</response>

I set up a transform in Jitterbit, with a single-field text format to HTTP Target with the same URL as above. The transform has this script in the single-field mapping element:

Code: Select all

<trans>
$formdata = "username="+$splunkUser+"&password="+$splunkPwd;
WriteToOperationLog("Using form data " + $formdata);
$formdata
</trans>

When I run the operation, it fails with:

Code: Select all

Fatal Error
Failed to post to the url 'https://loginspect.iowa.gov/api/services/auth/login'. The last (and probably most relevant) error was: The server returned HTTP Status Code : 401 Unauthorized  Error is: The requested resource requires user authentication. Headers sent by the server: HTTP/1.1 401 Unauthorized Date: Fri, 26 Aug 2011 16:29:50 GMT Server: Splunkd Content-Length: 81 Content-Type: text/xml; charset=utf-8  The response was: <response> <messages> <msg type="WARN">Login failed</msg> </messages> </response>


It seems like Jitterbit is not sending what I think it is. How can I go about seeing the raw data that is sent by Jitterbit? Or is there another approach that would work better?

Thanks,
M.

[emanuel]

Hi,

I'm assuming that you are using a text target with a single field to write the form data. Jitterbit adds a line-break to this because it thinks that it's a CSV target and many form posts don't expect that. We have a global data element that you can set to remove it:

$jitterbit.target.http.remove_trailing_linebreaks = true

Set it in a script or transformation mapping before the http target.

You can also write the form data directly to the url using WriteFile in a script (no need for the transformation)

$formdata = "username="+$splunkUser+"&password="+$splunkPwd;
WriteFile("<TAG>Testalite - 4.0/Targets/Http end-point</TAG>", $formdata);
Eval(FlushFile("<TAG>Testalite - 4.0/Targets/Http end-point: archive</TAG>"), WriteToOperationLog(GetLastError()));

The response will be written to the designated target as configured in the http target.

/Cheers
Emanuel

[mtutty]

Score! Tried the first approach, and it works fine. Just needed to sort out the extra newline. This was not apparent from the curl debug log, so it might be worth noting somewhere in the help for HTTP targets.