All Apps and Add-ons

Splunk Addon Builder Authentication Failed

gabriele_chini
Loves-to-Learn

I created my own app using Splunk Add-On Builder that captures some events via an API. I'm using Python input. After a few hours I get an authentication error in some of the code automatically generated by the Splunk add-on builder. I'll put the error below. Can anyone help me? Thank you

2025-01-27 10:49:55,230 log_level=ERROR pid=49602 tid=MainThread file=base_modinput.py:log_error:309 | Traceback (most recent call last):

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 321, in wrapper

    return request_fun(self, *args, **kwargs)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 76, in new_f

    val = f(*args, **kwargs)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 737, in get

    response = self.http.get(path, all_headers, **query)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1272, in get

    return self.request(url, {'method': "GET", 'headers': headers})

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1344, in request

    raise HTTPError(response)

splunklib.binding.HTTPError: HTTP 401 Unauthorized -- b'{"messages":[{"type":"WARN","text":"call not properly authenticated"}]}'

 

During handling of the above exception, another exception occurred:

 

Traceback (most recent call last):

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 262, in _handle_auth_error

    yield

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 330, in wrapper

    return request_fun(self, *args, **kwargs)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 76, in new_f

    val = f(*args, **kwargs)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 737, in get

    response = self.http.get(path, all_headers, **query)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1272, in get

    return self.request(url, {'method': "GET", 'headers': headers})

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 1344, in request

    raise HTTPError(response)

splunklib.binding.HTTPError: HTTP 401 Unauthorized -- b'{"messages":[{"type":"WARN","text":"call not properly authenticated"}]}'

 

During handling of the above exception, another exception occurred:

 

Traceback (most recent call last):

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 113, in stream_events

    self.parse_input_args(input_definition)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 154, in parse_input_args

    self._parse_input_args_from_global_config(inputs)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/modinput_wrapper/base_modinput.py", line 173, in _parse_input_args_from_global_config

    ucc_inputs = global_config.inputs.load(input_type=self.input_type)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunktaucclib/global_config/configuration.py", line 277, in load

    input_item["name"], input_item["entity"]

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunktaucclib/global_config/configuration.py", line 189, in _load_endpoint

    RestHandler.path_segment(self._endpoint_path(name)), **query

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 330, in wrapper

    return request_fun(self, *args, **kwargs)

  File "/opt/splunk/lib/python3.7/contextlib.py", line 130, in __exit__

    self.gen.throw(type, value, traceback)

  File "/opt/splunk/etc/apps/myapp/bin/myapp/aob_py3/splunklib/binding.py", line 265, in _handle_auth_error

    raise AuthenticationError(msg, he)

splunklib.binding.AuthenticationError: Authentication Failed! If session token is used, it seems to have been expired.

Labels (1)
0 Karma

tej57
Builder

Hello @gabriele_chini,

Can you provide the code you use for generating the token and do you save it in kvstore? How long does the token stay active and do you regenerate the token if it has already been expired?

Thanks,
Tejas. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...