All Apps and Add-ons

Why am I getting "Splunk connectivity error: HTTP 401 -- Login failed" configuring the Splunk User Behavior Analytics (Splunk UBA) data source?

New Member

Hi All,
I'm getting a error in Configuring the Splunk UBA data source. Before it worked perfectly, but now all data sources status are in Processing and getting a error:

Splunk connectivity error: HTTP 401 -- Login failed
0 Karma

Splunk Employee
Splunk Employee

Probably too late to help you, but for anyone else who stumbles across this... these errors are typically just as they seem -- HTTP 401 should just mean that your credentials are not valid. UBA is just a client of Splunk, so you can validate this by logging into the search head with the same credentials. If you have a UBA data source that was running and no longer does, we can also check the system logs to see if there's anything else interesting there (open a support request and voice this problem), but it should be just a matter of checking your credentials.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!