Proofpoint TAP Modular Input App: Autologin succeeded, but there was an auth error on next request. Something is very wr

[ferdydek]

I'm facing issue setting up modular input for Proofpoint TAP.

splunkd.log:

INFO ModularInputs - Autologin succeeded, but there was an auth error on next request. Something is very wrong.
WARN ModularInputs - Argument validation for scheme=proofpoint_tap_siem failed: Autologin succeeded, but there was an auth error on next request. Something is very wrong.

API principle and server work well when tested with curl.

Tested on 7.3.0 and 8.0.6 splunk heavy forwarder. Splunk is behind squid proxy with not SSL manipulation. Other TA's on this box don't have issues accessing data on the internet.

@eckolp2003 any hints where to look ?

[subvocal]

Hi @ferdydek - It's been a while since you posted. I'm a Product Manager at Proofpoint and can help you get this solved. Are you still seeing this issue when using the Proofpoint TAP modular input?