topic Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0? in Splunk Search

Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0?

dimitrkovalsky — Wed, 17 Jun 2015 10:23:14 GMT

Hello

I am using Splunk java sdk 1.4.0.0 when I execute this query :

String QUERY = "search \"ab_exper\" index=my_apache | rex \".+cohort%7C(?<cohort>.+)%3Bcampaign%7C(?<campaign>.+)%3Brecipe%7C(?<recipe>.+)%3Bplatform.+\" | stats count(recipe) as recipe_count by campaign, recipe";

ServiceArgs loginArgs = new ServiceArgs();
        loginArgs.setUsername(user);
        loginArgs.setPassword(password);
        loginArgs.setHost(splunkHost);
        loginArgs.setPort(port);

        Service service = Service.connect(loginArgs);
        JobArgs jobArgs = new JobArgs();
        jobArgs.setExecutionMode(JobArgs.ExecutionMode.BLOCKING);
        jobArgs.put("earliest_time", dateFormat.format(new Date(from)));
        jobArgs.put("latest_time", dateFormat.format(new Date(to)));

        Job job = service.getJobs().create(QUERY, jobArgs);
        return parseForRawEntries(job);

I receive different errors :
One of them is 401call not properly authenticated. (And I see [Fatal Error] :1:1: Premature end of file. in console)
Another - unexpected end of file from server.
Authentication is success and returns 200 status.

What could be the problem?

Thanks, Dmytro

Re: Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0?

dimitrkovalsky — Tue, 23 Jun 2015 14:06:13 GMT

It happens when I use earliest_time less than (current - 86400000L) (more than one day).

Re: Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0?

jnicholsenernoc — Tue, 23 Jun 2015 14:12:57 GMT

I think that error is from when you are hitting splunk web and not splunkd. Make sure you are going against the proper hostname and especially port. Splunk web, on port 80 or 443 or 8000 isn't the same as talking to splunkd on port 8089.

http://dev.splunk.com/view/python-sdk/SP-CAAAEFC

Re: Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0?

jnicholsenernoc — Tue, 23 Jun 2015 17:18:07 GMT

http://dev.splunk.com/view/python-sdk/SP-CAAAEFC