AMQP Messaging Modular Input: How to troubleshoot error "Can't connect to Splunk REST API with the token..."?

agneticdk — Thu, 18 Aug 2016 09:24:17 GMT

We get this, when running AMPQ 1.0:

08-18-2016 09:00:42.492 +0000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\amqp_ta\bin\amqp.py"" Can't connect to Splunk REST API with the token [Splunk oaDn882xZVK78X6VYq4a6dk9A9W4XIYv7BumV0Nci2alOe9tm9tRo6zWes^jBPz0TIryEFE^wI6^019iaoWwZgeMgVC1a300mrid_UssLdE88nQH8tKoeC], either the token is invalid or SplunkD has exited : HTTP 500 --

It runs on a 6.4.2 heavy forwarder on Windows 2012r2.

So it looks like some problems with auth token to Splunk.

We have tried different stuff around the Java security, and checked that Splunk runs tls and sslv3.

All checks out ok. We also tried Java JDK instead of JRE, but we still get the error.

Any comments?

Re: AMQP Messaging Modular Input: How to troubleshoot error "Can't connect to Splunk REST API with the token..."?

Damien_Dallimor — Wed, 24 Aug 2016 10:31:15 GMT

As per the documentation , AMQP 1.0 is not supported.

topic Re: AMQP Messaging Modular Input: How to troubleshoot error "Can't connect to Splunk REST API with the token..."? in All Apps and Add-ons

AMQP Messaging Modular Input: How to troubleshoot error "Can't connect to Splunk REST API with the token..."?

Re: AMQP Messaging Modular Input: How to troubleshoot error "Can't connect to Splunk REST API with the token..."?