Probably too late to help you, but for anyone else who stumbles across this... these errors are typically just as they seem -- HTTP 401 should just mean that your credentials are not valid. UBA is just a client of Splunk, so you can validate this by logging into the search head with the same credentials. If you have a UBA data source that was running and no longer does, we can also check the system logs to see if there's anything else interesting there (open a support request and voice this problem), but it should be just a matter of checking your credentials.
