How to resolve this error: HTTP 401 -- call not properly authenticated dbconnect?

[glpadilla_sol]

Hello hello,

We have the Splunk db connect app working in our environment, but suddenly stops working

And I can see this log:

2022-11-21 23:22:39.050 -0500 [dw-203047 - PUT /api/inputs/server_average_latency] ERROR c.s.d.m.repository.DefaultConfigurationRepository - action=failed_to_get_the_conf reason=HTTP 401 -- call not properly authenticated com.splunk.HttpException: HTTP 401 -- call not properly authenticated at com.splunk.HttpException.create(HttpException.java:84) at com.splunk.DBXService.sendImpl(DBXService.java:131) at com.splunk.DBXService.send(DBXService.java:43) at com.splunk.HttpService.get(HttpService.java:154) at com.splunk.Entity.refresh(Entity.java:381) at com.splunk.Entity.refresh(Entity.java:24) at com.splunk.Resource.validate(Resource.java:186) at com.splunk.Entity.validate(Entity.java:462) at com.splunk.Entity.getContent(Entity.java:157) at com.splunk.Entity.size(Entity.java:416) at java.util.HashMap.putMapEntries(HashMap.java:501) at java.util.HashMap.<init>(HashMap.java:490) at com.splunk.dbx.model.repository.JsonMapperEntityResolver.apply(JsonMapperEntityResolver.java:34) at com.splunk.dbx.model.repository.JsonMapperEntityResolver.apply(JsonMapperEntityResolver.java:18) at com.splunk.dbx.model.repository.DefaultConfigurationRepository.get(DefaultConfigurationRepository.java:92) at com.splunk.dbx.server.dbinput.task.DbInputTaskLoader.load(DbInputTaskLoader.java:63) at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.update(InputServiceImpl.java:221) at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.update(InputServiceImpl.java:38) at com.splunk.dbx.server.api.resource.InputResource.updateInput(InputResource.java:81) at sun.reflect.GeneratedMethodAccessor482.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43... CONTINUES

I am not going to add the whole log because is huge.

We have a cluster and our dbconnect is install at the search heads and all the inputs are configured at the Heavy Forwarder.

Is you have any idea what I can check to see what is the issue, please let me know.

The environment is over linux.

Thanks in advance.

Best Regards.

[glpadilla_sol]

This was something odd.

After a lot of troubleshooting I decided to restart the Splunk service of the Heavy Forwarder, where the dbconnect was configured.

And after that I started receiving the logs and the issue not there anymore.