topic Re: Authorization Token Not Work in Splunk Enterprise

Authorization Token Not Work

chenfan — Tue, 01 Jul 2025 07:15:28 GMT

Hi Splunker,

I tried to enable/disable with API, but I encountered problems with token authentication. I always get the following error. I have also adjusted the API information, but I still can't solve this problem.

curl -v -X POST -k -H "Authorization: Bearer dc73xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi" -d enabled=0

It will be really great if you could share some working examples somewhere in your documentation.

Thanks in advance!

Re: Authorization Token Not Work

livehybrid — Tue, 01 Jul 2025 07:57:28 GMT

Hi @chenfan

There are two types of token, one is a JWT token that you can create in the UI via the Tokens page (Bearer). The other is by logging in to the /services/auth/login endpoint and retrieving a session token..

Based on your short token length I suspect you are using a session token (and JWT tokens often start "eyJ") which means the Authorization type should be "Splunk" not "Bearer"

Bearer: Means to use a bearer token header, the standard for Javascript Object Notation (JSON) Web Tokens (JWTs), on which Splunk authentication tokens are based. Splunk: Means to use the Splunk header for authentication.

Try the following:

curl -v -X POST -k -H "Authorization: Splunk dc73xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi" -d enabled=0

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Authorization Token Not Work

chenfan — Tue, 01 Jul 2025 09:06:03 GMT

Hi @livehybrid

Thankyou for your reply!

I have tried,but it not work.

And this is my token

Re: Authorization Token Not Work

PrewinThomas — Tue, 01 Jul 2025 09:29:29 GMT

@chenfan
Any error messages on splunkd.log?

You can also refer #https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.3/authenticate-into-the-splunk-platform-with-tokens/troubleshoot-token-authentication

Can you create another token with admin account and test the same.

Also test without token,
curl -k -u admin:yourpassword https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi -d enabled=0

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Authorization Token Not Work

livehybrid — Tue, 01 Jul 2025 10:56:38 GMT

Hi @chenfan

That string starting dc736 is *not* your token. This is the token ID.

Its not possible to retrieve the token once created so copy it somewhere safe. If using this type of token then you will need to set use "Bearer" as you were doing before.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Authorization Token Not Work

chenfan — Wed, 02 Jul 2025 05:25:20 GMT

Yep，I can use useraccount&password to do it.

Re: Authorization Token Not Work

chenfan — Wed, 02 Jul 2025 05:26:50 GMT

Thank you for your advice, I ignored the token content and cloesd it.