https://community.splunk.com/t5/Getting-Data-In/On-Forwarder-WARN-AdminHandler-AuthenticationHandler-Denied/m-p/443971#M77306 <P>I am seeing messages like this:</P> <PRE><CODE>09-05-2018 13:23:47.416 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.429 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.436 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.436 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user </CODE></PRE> <P>Searched for them here but others see the message on search heads, while mine are from a Universal Forwarder, which should not be dispatching any distributed search.</P> <P>Any thoughts? Thank you for any help.</P> Wed, 05 Sep 2018 17:31:43 GMT ww9rivers 2018-09-05T17:31:43Z https://community.splunk.com/t5/Getting-Data-In/On-Forwarder-WARN-AdminHandler-AuthenticationHandler-Denied/m-p/443971#M77306 <P>I am seeing messages like this:</P> <PRE><CODE>09-05-2018 13:23:47.416 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.429 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.436 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user 09-05-2018 13:23:47.436 -0400 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user </CODE></PRE> <P>Searched for them here but others see the message on search heads, while mine are from a Universal Forwarder, which should not be dispatching any distributed search.</P> <P>Any thoughts? Thank you for any help.</P> Wed, 05 Sep 2018 17:31:43 GMT https://community.splunk.com/t5/Getting-Data-In/On-Forwarder-WARN-AdminHandler-AuthenticationHandler-Denied/m-p/443971#M77306 ww9rivers 2018-09-05T17:31:43Z