Receiving HTTP 303 When Using Token-Based Authentication with Splunk Cloud REST API

[asah]

Hi Splunk Gurus, 

I’m working on a script to programmatically check if logs from a specific host are available in Splunk. For this, I’m using token-based authentication. I’ve created a role and a user with the necessary permissions, and generated a token for that user.

However, when I try to run the following curl command against my Splunk Cloud instance:

curl -k -H "Authorization: Bearer <your_token>" \ https://<your_splunk_instance>.splunkcloud.com:443/services/server/info

I receive a 303 status code, and I’m not sure what I might be doing wrong. I’ve checked multiple forums but haven’t been able to find a clear solution.

Could you please help me understand what might be causing this and how I can resolve it?

Thank you in advance!

[thahir]

Hi @livehybrid ,

i have one query, As far as I understand, due to security restrictions, this 8089 port might be blocked or not exposed externally in the Splunk Cloud.

Thanks in Advance

[livehybrid]

Hi @asah 

Change the port in your URL from 443 to 8089, as the Splunk REST API endpoints are served on the management port (8089) rather than the web port (443).

You curl command should look like this:

curl -k -H "Authorization: Bearer <your_token>" https://<your_splunk_instance>.splunkcloud.com:8089/services/server/info

This assumes your authentication token is valid and has the necessary permissions (e.g., for accessing server info).

A 303 status code typically indicates a redirect, which can occur when hitting the wrong port or endpoint in Splunk Cloud.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing