topic Re: WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user in Security

WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

qjvtenkroode — Mon, 14 Jan 2013 18:47:15 GMT

I'm getting this warning on my search peers. After some digging around (and trying this on some brand spanking new setups) I found out it has something to do with Splunk calling services/admin/auth-keys and not getting an appropriate response back. But I'm still baffled why, at first I thought I misconfigured something but after doing a test setup with just one search head and one search peer I get the same issue. This makes me doubt if this is "working as intended" or something else..

Any ideas anyone?

Re: WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

jonathon — Fri, 18 Jul 2014 00:17:07 GMT

I'm getting these too across 64 indexers and am trying to determine what's causing it. I've walked through all of the my search peers and haven't found one with bad keys yet.

Re: WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

lakshman237 — Fri, 17 Apr 2015 04:36:43 GMT

Hopefully this resolved by now. This usually appears when the search head cannot authenticate with search peers in the distributed environment. Pls re-authenticate either using CLI or from the GUI within the search head : settings-> distributed search -> Search peers and ensure, its up and enabled.