C# Rest API Authentication Failed

[gmusumeci]

I have an app on C# that writes directly into Splunk index (without forwarder).

I tested it on our prod environment running Splunk Enterprise and the Trial and works fine.

But when I run the tool on my development server running Splunk Free the app is stop working.

The error I got is "The remote server returned an error: (401) Unauthorized."

Look like authentication is disable on free version.

I believe C# SDK for Splunk works only with authorized connection.

Anyone can confirm if auhtentication is disabled or write is not allowed on the Free version?

Thanks! Guillermo

[Damien_Dallimor · Accepted solution]

In your server.conf file on your Free License version of Splunk , what is your allowRemoteLogin value set to ? Try "always".

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Serverconf

Also , you might want to look a signing up for a Splunk developer license.

[gmusumeci]

Hi Damien

I added the allowRemoteLogin=always, restarted Splunk service and works now.

Thank you very much! Guillermo

[gmusumeci]

Hello,

Thank you for your response.

Any ideas what can cause the error on free version? The code works fine with enterprise.

Can you please post an example how to write directly into indexer?

Thanks! Guillermo

[linu1988]

There is no code which i can share here, I had tried it and it was working. You can apply a little exception handling to see where and what exactly the error is.

I guess you might have seen this already:
_http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQE

[linu1988]

It works on free version, i have tested it