splunk sdk : com.splunk.HttpException: HTTP 401 -- call not properly authenticated

[radhika123456789]

I am trying to search the string from splunk , i was getting 401 error.
StringBuilder searchString = new StringBuilder();

    searchString.append("search").append(" XXX");

Service service = Service.connect(splunkArgs);
Job job = service.getJobs().create(searchString.toString());

[itay]

Can you tell us a bit more about your environment (version of Splunk, OS, using a load balancer, etc)? Also, are these the same credentials you use when you log into the web UI?

[glennblock]

It sounds like if you are getting a 401 that the username or password may not be correct.

[radhika123456789]

i resolved the 401 issue, i am getting now (java.lang.RuntimeException: java.lang.RuntimeException: ParseError at [row,col]:[1,1]
Message: Premature end of file.) while response parsing

[radhika123456789]

Service service = new Service("hostname", portnumber);
String credentials = "username:password";
String basicAuthHeader = Base64.encode(credentials.getBytes());
service.setToken("Basic " + basicAuthHeader);

[itay]

@radhika123456789 if you were just giving your username and password before to the connect method, it should work too. There should not be a reason for you to use basic auth.

[radhika123456789]

I need to write the search query using or condition like hostname=a or b, need to searc the query with hostname a or b.How could we write in search query using java
spunk sdk.

[radhika123456789]

Regarding "HTTP 401 -- call not properly authenticated", i noticed this is issue is comming when i use service.connect(serviceargs).HTTP 401 -- call not properly authenticated.
When we use splunkargs to connect, creating token and using that token while doing search.
some how that token is not authenticated, bcs of tht we are seeing : HTTP 401 -- call not properly authenticated.

[stelles]

Did you ever figure out your authentication problem?

I'm going to assume this has been resolved.

[ivansd]

This issue is still present:

ServiceArgs loginArgs = new ServiceArgs();
loginArgs.setUsername("username");
loginArgs.setPassword("password");
loginArgs.setHost(host);
loginArgs.setPort(Integer.parseInt(port));
Service.connect(loginArgs);

Then, I check if login is successful by having this line of code:

System.out.println("Installed apps: " + service.getApplications().keySet());
I get all apps and then search with JobExportArgs exportArgs = new JobExportArgs();

exportArgs.setEarliestTime("-5");
exportArgs.setLatestTime("now");
exportArgs.setRequiredFieldList("string");
exportArgs.setSearchMode(JobExportArgs.SearchMode.NORMAL);

InputStream exportSearch = service.export(searchQuery, exportArgs);

Call fails at above line (service.export(searchQuery, exportArgs)) - com.splunk.HttpException: HTTP 401 -- call not properly authenticated

[shakeelmohamed]

@ivansd can you provide us with some details about your environment? (Splunk version, OS, load balancer, etc.)

[ppchava]

we are also experiencing similar issue 'com.splunk.HttpException: HTTP 401 -- call not properly authenticated' while trying to connect to Splunk..

we are spawning multiple threads(approximately 10) to access splunk and running multiple splunk queries..

Splunk version - 6.3.2

Here is code snippet.
ServiceArgs loginArgs = new ServiceArgs();
loginArgs.setUsername(username);
loginArgs.setPassword(password);
loginArgs.setHost(host);
loginArgs.setPort(port);
loginArgs.setApp(app);
Service splunkSrv = Service.connect(loginArgs);

[itay]

Since we know this code path works, the best suggestion for this issue is to open a support ticket via support@splunk.com with your Support entitlements, since it may be something specific to your environment.

[shakeelmohamed]

Closing due to inactivity

[nmaiorana]

HTTP 401 -- {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}

We are seeing this error intermittently. From what I can tell, it happens after the request is submitted to the server. I even suspect the query itself is being executed. I suspect this because our Splunk team is reporting more concurrent sessions for our user than is possible for us.

Is it possible the error messes is incorrect? I ask this because we get this once in a while from a process that is running and submits the request in the same way every time.

[tdhellmann]

Hi @nmaiorana - It would help us to know a bit more about your situation:

Which version of Splunk Enterprise, the Splunk Java SDK, and Java are you running on?
What does your Splunk Enterprise deployment look like (SHC, load balancing, etc.) ?
Can you provide a code snippet that leads to the error?
How many concurrent sessions are you seeing for your user?
How long does your search take to process?

Thanks

[mdharmesh]

@nmaiorana Even I am facing the same issue. Mainly it occurs once in a while.
com.splunk.HttpException: HTTP 401 -- call not properly authenticated

[RakeshAMore]

Facing similar issue. I have verified that my username and password are correct but this is mainly happening when I tried to make multiple calls at time using multiple threads.

[RakeshAMore]

I am able to resolve this issue by minimising number of concurrent requests to splunk server, now it is working fine thanks

[pawarakesh]

I was getting the same error. I have fixed this problem by upgrading splunk-sdk-java library from 1.3.2 to 1.6.5 (latest one). Now it's working fine.

[SurajMenon]

I am seeing the issue even after upgrading to 1.6.5.
Following is the maven dependency that I have:

com.splunk splunk 1.6.5.0

[pawarakesh]

try to download , use it and see if it fixes, http://dev.splunk.com/goto/sdk-java-jar , you can add this manually in your maven repo/build server/common repo .

[SurajMenon]

I get the issue, even with the jar from Splunk.
FYI, I am packing the Splunk jar into an executable jar using spring-boot-maven-plugin and using multiple threads to run multiple simultaneous queries.

[shakeelmohamed]

@SurajMenon I've reopened this issue so we don't lose it. If you have some repro steps, we can take a look when we get around to it. We're always open to a PR if you're interested in contributing!

[chris05atm]

This may be related to session expiration and the lack of threading controls in the SDK. See my other recent ticket #139.

[Abrar-Snap]

Is this fixed somewhere or still an issue? I still see this error.

Caused by: com.splunk.HttpException: HTTP 401 -- call not properly authenticated
at com.splunk.HttpException.create(HttpException.java:84)
at com.splunk.HttpService.send(HttpService.java:452)
at com.splunk.Service.send(Service.java:1293)
at com.splunk.HttpService.get(HttpService.java:150)
at com.splunk.Entity.refresh(Entity.java:381)
at com.splunk.Entity.refresh(Entity.java:24)
at com.splunk.Resource.validate(Resource.java:174)
at com.splunk.Entity.validate(Entity.java:462)
at com.splunk.Entity.getContent(Entity.java:157)
at com.splunk.Entity.getString(Entity.java:279)
at com.splunk.ServiceInfo.getVersion(ServiceInfo.java:155)
at com.splunk.Service.login(Service.java:1128)

[bparmar-splunk]

Hi @Abrar-Snap,
We are recommending users to make use of Bearer token instead of Splunk token, because it is configurable and long lived token.