topic Re: (401 Unauthorized Exception)Unable to send query using java SDK in Splunk Dev

(401 Unauthorized Exception)Unable to send query using java SDK

madhuinfy — Mon, 28 Sep 2020 14:26:50 GMT

Hi,
I am connecting splunk with java sdk and trying to send a query. Its getting connected but when i am trying to send a query it behaves weirdly .Some time it gives the result but some times it gives com.splunk.HttpException: HTTP 401 -- call not properly authenticated.
The same query executes fine but most of the time it gives the above exception. I am unable to proceed further due to the above issue. Kindly help me out. Please find the below code.
ServiceArgs loginArgs = new ServiceArgs();
loginArgs.setUsername("username");
loginArgs.setPassword("password");
loginArgs.setHost("hostname");
loginArgs.setPort(8089);
Service service = Service.connect(loginArgs);
System.out.println("Connected");
String searchQuery_normal ="search index=app sourcetype=tomcat_access host=\"cglita*\" (source=\"/var/opt/tomcat/logs/saelHDcomNavAndSearchWebService/access.log\" OR source=\"/var/opt/tomcat/logs/saelHDcomProductDataWebService/access.log\" OR source=\"/var/opt/tomcat/logs/saelOnlineStoreFinder/access.log\") uri!=\"Probe\"| timechart count as \"Pageviews\", avg(response_time) as \"Response Time\" by source | tail 5 ";
JobArgs jobargs = new JobArgs();
jobargs.setExecutionMode(JobArgs.ExecutionMode.NORMAL);
jobargs.setEarliestTime("-15m@m");
jobargs.setLatestTime("now");
Job job = service.getJobs().create(searchQuery_normal,jobargs);
JobResultsArgs resultsArgs = new JobResultsArgs();
resultsArgs.setOutputMode(JobResultsArgs.OutputMode.XML);
InputStream results = job.getResults(resultsArgs);
ResultsReaderXml resultsReader=new ResultsReaderXml(results);
//ResultsReaderCsv resultsReader=new ResultsReaderCsv(results);
//ResultsReaderJson resultsReader = new ResultsReaderJson(results);
HashMap event;
System.out.println("\nFormatted results from the search job as CSV\n");
while ((event = resultsReader.getNextEvent()) != null) {
for (String key: event.keySet())
System.out.println(" " + key + ": " + event.get(key));
}
resultsReader.close();
} catch (Exception e) {
e.printStackTrace();

Re: (401 Unauthorized Exception)Unable to send query using java SDK

Damien_Dallimor — Mon, 29 Jul 2013 09:06:11 GMT

Are the 401 errors interleaved with successful requests , or do they only start occurring after a period of time ?

Re: (401 Unauthorized Exception)Unable to send query using java SDK

madhuinfy — Mon, 29 Jul 2013 09:35:05 GMT

Hi,
Most of the time they only start occurring after a period of time, but some times it will through in the beginning of the execution only.

Re: (401 Unauthorized Exception)Unable to send query using java SDK

madhuinfy — Mon, 29 Jul 2013 09:35:29 GMT

Hi,
Most of the time they only start occurring after a period of time, but some times it will through in the beginning of the execution only

Re: (401 Unauthorized Exception)Unable to send query using java SDK

Damien_Dallimor — Mon, 29 Jul 2013 09:44:31 GMT

what is the sessionTimeout value in server.conf

Re: (401 Unauthorized Exception)Unable to send query using java SDK

madhuinfy — Mon, 29 Jul 2013 11:52:12 GMT

splunk server is located in a remote system so i cannot see the details of server.conf. but if i login to splunk app directly and execute the query , it executes as many times as i want with out any issue. I guess there is no problem with the session time out else i would get the same error when i run the query with splunk web.

Re: (401 Unauthorized Exception)Unable to send query using java SDK

Damien_Dallimor — Mon, 29 Jul 2013 14:32:57 GMT

Is there anything on the network between your java client and splunkd that could be affecting the authentication token in the HTTP header ?Or anything in you code ?

How are you using your Service object in your code ? Singleton ?

Re: (401 Unauthorized Exception)Unable to send query using java SDK

madhuinfy — Tue, 30 Jul 2013 05:31:36 GMT

Hi,
There is nothing between splunkd and java client. I am just using my ldap id and password to connect to splunk. No service object is not a singleton in my code.