Splunk throwing HTTP 401 not authorized error when called from Java SDK

raghav130593 — Wed, 28 Dec 2016 03:08:40 GMT

I have multiple GetSplunk processors running using a Cron driven scheduling strategy. The Cron expression looks like '0 30 13 * * ?'. They all successfully execute the query the first time it's run. But, the next day it errors out with a 401 error from Splunk. The error from nifi-app.log is as below. The Cron scheduler in NiFi is a QuartzScheduler.
WARN [Timer-Driven Process Thread-7] o.a.n.c.t.ContinuallyRunProcessorTask Administratively Yielding GetSplunk[id=01581009-026c-114b-5e2e-401ebea6427d] due to uncaught Exception: com.splunk.HttpException: HTTP 401 -- call not properly authenticated 2016-12-21 13:30:00,300 WARN [Timer-Driven Process Thread-2] o.a.n.c.t.ContinuallyRunProcessorTask com.splunk.HttpException: HTTP 401 -- call not properly authenticated at com.splunk.HttpException.create(HttpException.java:84) ~[na:na] at com.splunk.HttpService.send(HttpService.java:452) ~[na:na] at com.splunk.Service.send(Service.java:1293) ~[na:na] at com.splunk.HttpService.get(HttpService.java:165) ~[na:na] at com.splunk.Service.export(Service.java:222) ~[na:na] at com.splunk.Service.export(Service.java:237) ~[na:na] at org.apache.nifi.processors.splunk.GetSplunk.onTrigger(GetSplunk.java:461) ~[na:na] at org.apache.nifi.processor.AbstractProcessor.onTrigger(AbstractProcessor.java:27) ~[nifi-api-1.1.0-SNAPSHOT.jar:1.1.0-SNAPSHOT] at org.apache.nifi.controller.StandardProcessorNode.onTrigger(StandardProcessorNode.java:1064) ~[nifi-framework-core-1.1.0-SNAPSHOT.jar:1.1.0-SNAPSHOT] at org.apache.nifi.controller.tasks.ContinuallyRunProcessorTask.call(ContinuallyRunProcessorTask.java:136) [nifi-framework-core-1.1.0-SNAPSHOT.jar:1.1.0-SNAPSHOT] at org.apache.nifi.controller.tasks.ContinuallyRunProcessorTask.call(ContinuallyRunProcessorTask.java:47) [nifi-framework-core-1.1.0-SNAPSHOT.jar:1.1.0-SNAPSHOT] at org.apache.nifi.controller.scheduling.QuartzSchedulingAgent$2.run(QuartzSchedulingAgent.java:165) [nifi-framework-core-1.1.0-SNAPSHOT.jar:1.1.0-SNAPSHOT] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_101] at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_101] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) [na:1.8.0_101] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) [na:1.8.0_101] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_101] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_101] at java.lang.Thread.run(Thread.java:745) [na:1.8.0_101]

The GetSplunk processor makes use of Java SDK for Splunk. My earliest time is '-24h' and latest time is 'now'. I am hitting splunkd with port 8089.
Help appreciated.

Re: Splunk throwing HTTP 401 not authorized error when called from Java SDK

jantreassian — Tue, 31 Jan 2017 15:23:59 GMT

@raghav130593, which version of the Splunk SDK are you using?
I'm having this issue as well with version 1.3.2.

Re: Splunk throwing HTTP 401 not authorized error when called from Java SDK

raghav130593 — Tue, 31 Jan 2017 23:17:16 GMT

I found the issue. It was a lazy authorization issue within Apache Nifi's GetSplunk processor and not really Splunk's issue. The session that getting created used to expire and a new session wasn't getting created consecutive times within the cron scheduler.

topic Splunk throwing HTTP 401 not authorized error when called from Java SDK in Alerting

Splunk throwing HTTP 401 not authorized error when called from Java SDK

Re: Splunk throwing HTTP 401 not authorized error when called from Java SDK

Re: Splunk throwing HTTP 401 not authorized error when called from Java SDK