All Apps and Add-ons

Splunk Cloud Gateway - Splunk AR Device Registration Issues


I am Unable to register a clients Splunk AR device through the gateway.

All other devices we've tested seem to work no problem, both viewing dashboards from QR codes and registering devices. The modular input scripts are all running (I have restarted splunk and also disabled/enabled them on through the UI) and the Cloud Gateway Status Dashboard all looks good/green. Everything seems to be working except the clients iPhone.

The client has provided several keys now including via screenshot (ruling out typos) but always returns Invalid activation code.

Client installed the app from the App Store late last week, so it should be reasonably current.

Here are the relevant bits of $SPLUNK_HOME/var/log/splunk/splunk_app_cloudgateway.log

2019-05-20 12:41:27,331 ERROR [rest_base] [base_endpoint] [handle] [3253] Spacebridge error
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/rest/", line 54, in handle
    res = self.get(request)
  File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/rest/", line 55, in get
    return handle_query(auth_code, device_name, user, system_authtoken)
  File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/rest/", line 75, in handle_query
    sb_response = sb_http.authentication_query_request(auth_code, encryption_context)
  File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/rest/services/", line 57, in authentication_query_request
SpacebridgeServerError: Spacebridge request error: Unknown authentication code

2019-05-20 12:41:26,575 INFO [rest_base] [base_endpoint] [handle] [3253] in base rest class request is:{u'session': {u'user': u'tom', u'authtoken': u'MASKED'}, u'connection': {u'listening_port': 8000, u'src_ip': u'MASKED', u'ssl': False}, u'lang': u'en-US', u'output_mode': u'xml', u'query': {u'device_name': u'jw2', u'auth_code': u'NEAJF55HQN'}, u'restmap': {u'conf': {u'script': u'spacebridgeapp/rest/', u'passPayload': u'true', u'passHttpHeaders': u'true', u'handler': u'spacebridgeapp/rest/registration_query_handler.RegistrationQueryHandler', u'match': u'/registration/query', u'capability.get': u'cloudgateway_write', u'passSystemAuth': u'true', u'requireAuthentication': u'true', u'passHttpCookies': u'true', u'output_modes': u'json', u'scripttype': u'persist'}, u'name': u'script:registration_query'}, u'cookies': [[u'splunkweb_csrf_token_8000', u'MASKED'], [u'session_id_8000', u'MASKED'], [u'splunkd_8000', u'MASKED']], u'headers': [[u'Host', u'MASKED:8000'], [u'Connection', u'keep-alive'], [u'User-Agent', u'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36'], [u'Accept', u'*/*'], [u'Accept-Language', u'en-US,en'], [u'DNT', u'1'], [u'Accept-Encoding', u'gzip, deflate'], [u'Cookie', u'splunkweb_csrf_token_8000=MASKED; session_id_8000=MASKED; splunkd_8000=MASKED']], u'rest_path': u'/registration/query', u'output_mode_explicit': False, u'server': {u'guid': u'MASKED', u'servername': u'MASKED', u'rest_uri': u'', u'hostname': u'MASKED'}, u'method': u'GET', u'system_authtoken': u'MASKED'}
0 Karma


What is the version of the CloudGateway on the Splunk server?

There are no answer without questions
0 Karma


It is running 1.3.1 (and has done since it was installed) on top of Splunk Enterprise Server 7.2.6

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...