I'm able to log to the web UI but cannot access REST API

[wheresvic]

I have a Splunk Enterprise license and I have an admin user who can login via the web UI : http://localhost:8000/en-US/app/

This user also has the required user role which allows REST API access. I have also restarted the Splunk service a few times.

I still cannot login via the REST API

curl -k https://localhost:8089/services/auth/login --data-urlencode username=admin --data-urlencode password=splunklocal
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
100   164  100   129  100    35    686    186 --:--:-- --:--:-- --:--:--   872<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="WARN">Login failed</msg>
  </messages>
</response>

Note that this is on windows 10 - my colleague installed splunk on windows 7 and everthing worked fine

Splunk Enterprise Version: 7.1.3
Build: 51d9cac7b837

Any help would be very much appreciated!

[ssadanala1]

Change the password and give it a try . I believe you are using same password as GUI

[wheresvic]

I tried that as well - no luck 😞

curl -u admin:splunklocal -k https://localhost:8089/services/auth/login/ -d"username=admin&password=splunklocal" returns

<?xml version="1.0" encoding="UTF-8"?>
 <response>
  <messages>
    <msg type="WARN">Login failed</msg>
  </messages>
</response>

[harsmarvania57]

Try like this, curl -k -u admin:splunklocal https://localhost:8089/services/auth/login/ -d username=admin -d password=splunklocal

[wheresvic]

Tried as you suggested, also no luck...

[harsmarvania57]

Any error in $SPLUNK_HOME/var/log/splunk/splunkd.log ? I am able to run command which is given by me on Splunk 7.1.2 successfully.

[wheresvic]

Hi - no errors in splunkd.log either. I know it is supposed to work but it just doesn't - this is very weird 😞