Splunk Addon Builder Authentication Failed

gabriele_chini — Mon, 27 Jan 2025 11:04:53 GMT

I created my own app using Splunk Add-On Builder that captures some events via an API. I'm using Python input. After a few hours I get an authentication error in some of the code automatically generated by the Splunk add-on builder. I'll put the error below. Can anyone help me? Thank you

2025-01-27 10:49:55,230 log_level=ERROR pid=49602 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last):

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 321, in wrapper

return request_fun(self, *args, **kwargs)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 76, in new_f

val = f(*args, **kwargs)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 737, in get

response = self.http.get(path, all_headers, **query)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1272, in get

return self.request(url, {'method': "GET", 'headers': headers})

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1344, in request

raise HTTPError(response)

splunklib.binding.HTTPError: HTTP 401 Unauthorized -- b'{"messages":[{"type":"WARN","text":"call not properly authenticated"}]}'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 262, in _handle_auth_error

yield

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 330, in wrapper

return request_fun(self, *args, **kwargs)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 76, in new_f

val = f(*args, **kwargs)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 737, in get

response = self.http.get(path, all_headers, **query)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1272, in get

return self.request(url, {'method': "GET", 'headers': headers})

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1344, in request

raise HTTPError(response)

splunklib.binding.HTTPError: HTTP 401 Unauthorized -- b'{"messages":[{"type":"WARN","text":"call not properly authenticated"}]}'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 113, in stream_events

self.parse_input_args(input_definition)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 154, in parse_input_args

self._parse_input_args_from_global_config(inputs)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 173, in _parse_input_args_from_global_config

ucc_inputs = global_config.inputs.load(input_type=self.input_type)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunktaucclib/global_config/configuration.py", line 277, in load

input_item["name"], input_item["entity"]

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunktaucclib/global_config/configuration.py", line 189, in _load_endpoint

RestHandler.path_segment(self._endpoint_path(name)), **query

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 330, in wrapper

return request_fun(self, *args, **kwargs)

File "/opt/splunk/lib/python3.7/contextlib.py", line 130, in __exit__

self.gen.throw(type, value, traceback)

File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 265, in _handle_auth_error

raise AuthenticationError(msg, he)

splunklib.binding.AuthenticationError: Authentication Failed! If session token is used, it seems to have been expired.

Re: Splunk Addon Builder Authentication Failed

tej57 — Thu, 19 Jun 2025 12:07:32 GMT

Hello @gabriele_chini,

Can you provide the code you use for generating the token and do you save it in kvstore? How long does the token stay active and do you regenerate the token if it has already been expired?

Thanks,
Tejas.

topic Re: Splunk Addon Builder Authentication Failed in All Apps and Add-ons

Splunk Addon Builder Authentication Failed

Re: Splunk Addon Builder Authentication Failed