topic Re: Rest API - Returning 401 Unauthorized in Splunk Search

Rest API - Returning 401 Unauthorized

scriv — Tue, 29 Sep 2020 15:05:25 GMT

I'm getting a 401 Unauthorized error no matter what I try, when trying to access the REST API. I've tried with curl and via regular web browser, same error. I tried using the admin account, I tried creating a new account and a new role which has the following REST capabilities:
rest_apps_management
rest_apps_view
rest_properties_get
rest_properties_set

This new account's username and password is standard, no special characters.

curl -u restapi:password -k https://testserver:8089/services/search/jobs -d search="search *"

But I've also tried assigning the admin role and all the other capabilities. Nothing works. I get this error everytime. Is there something else that I need to set in Splunk? This is driving me bananas at this stage. We have a fully licencse on-side Splunk instance, but I am using the unlicensed latest version in a test environment.

Thanks for any help
Sean

Re: Rest API - Returning 401 Unauthorized

jkat54 — Thu, 27 Jul 2017 18:49:13 GMT

They also need the rest "tok" capabilities AND you must change the default admin password from changeme to something else.

Re: Rest API - Returning 401 Unauthorized

scriv — Tue, 29 Sep 2020 15:08:50 GMT

Thanks jkcat. The only capability that I could find with the word "tok" in it was "request_remote_tok", and enabling that didn't make a difference. Am I missing something? Also I changed the password from default, that didn't make a difference, either. Still getting the same 401 Unauthorized error

Re: Rest API - Returning 401 Unauthorized

jkat54 — Wed, 02 Aug 2017 15:44:21 GMT

Is there a proxy server configured on your host you're testing from?

Are you using splunk free or splunk lite?

Re: Rest API - Returning 401 Unauthorized

scriv — Mon, 14 Aug 2017 18:52:59 GMT

Not sure why, but the solution to this problem was to change the port to 8090!!

curl -u restapi:password -k https://testserver:8090/services/search/jobs -d search="search *"

Why would this be?

Re: Rest API - Returning 401 Unauthorized

jkat54 — Mon, 14 Aug 2017 19:37:35 GMT

I guess you've changed the SplunkD port somehow.

Re: Rest API - Returning 401 Unauthorized

scriv — Mon, 14 Aug 2017 22:25:46 GMT

I don't believe I did. I had no reason to at all.

Re: Rest API - Returning 401 Unauthorized

jkat54 — Mon, 14 Aug 2017 23:25:19 GMT

Can you post the output of this?

netstat -an | grep 808

Re: Rest API - Returning 401 Unauthorized

jkat54 — Mon, 14 Aug 2017 23:26:49 GMT

Also this

ps -ef | grep 808

Re: Rest API - Returning 401 Unauthorized

scriv — Tue, 15 Aug 2017 15:43:59 GMT

I have it installed on Windows Server 2012. What would the command be on that? The guy who found the solution to change the port in the command might have also changed the port in the server settings, so I'm asking and will let you know. Either way, there was still a problem with 8089

Re: Rest API - Returning 401 Unauthorized

scriv — Tue, 15 Aug 2017 15:54:55 GMT

It was just the port in the command that was changed to 8090 - nothing on the server was changed

Re: Rest API - Returning 401 Unauthorized

jkat54 — Tue, 15 Aug 2017 21:57:10 GMT

netstat -an | findstr :808

Please

Re: Rest API - Returning 401 Unauthorized

jkat54 — Tue, 15 Aug 2017 21:58:15 GMT

Please provide the output of this ran from a command prompt:

netstat -an | findstr :808

Re: Rest API - Returning 401 Unauthorized

scriv — Wed, 16 Aug 2017 11:47:15 GMT

netstat -an | findstr :808
TCP 0.0.0.0:8088 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8089 0.0.0.0:0 LISTENING

Re: Rest API - Returning 401 Unauthorized

jkat54 — Thu, 17 Aug 2017 22:48:33 GMT

This shows something is already listening on port 8089 so Splunk probably asked on startup if you'd like to use another port and chose the next available 8090.

Do you have a Splunk universal forwarder installed too?

Re: Rest API - Returning 401 Unauthorized

scriv — Fri, 18 Aug 2017 13:24:55 GMT

Nope, no universal forwarder in this dev environment - the fact that it is working now is that main thing, but thanks for all your help!

Re: Rest API - Returning 401 Unauthorized

jkat54 — Wed, 07 Mar 2018 17:59:01 GMT

ok so maybe in iptables you route port 8090 to 8089?

Re: Rest API - Returning 401 Unauthorized

Subarna — Sat, 26 Nov 2022 13:45:16 GMT

Hi Team

I am getting the below error while trying to access splunk Rest API . . I am trying to login using the username and password. Is there any other access required to successfully Login .Please help on the same.

Below is the code snippet

Map<String,Object> connectionArgs=new HashMap<String,Object>();
connectionArgs.put("host", "myHost");

connectionArgs.put("username", "myUsename");
connectionArgs.put("password", "myPassword");
connectionArgs.put("port",8089);
connectionArgs.put("scheme","https");

HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

Service service=Service.connect(connectionArgs);

Exception in thread "main" com.splunk.HttpException: HTTP 401 -- Login failed
at com.splunk.HttpException.create(HttpException.java:84)
at com.splunk.HttpService.send(HttpService.java:452)
at com.splunk.Service.send(Service.java:1293)
at com.splunk.HttpService.post(HttpService.java:308)