Getting Data In

Why am I unable to use token authentication on a universal forwarder

mvidal31
Engager

Hello the Splunk community

I'm trying to use the token authentication between an indexer and a universal forwarder. All seems to be good on my indexer, but the UF doesn't seem to understand the configuration.
This is my configuration in /local/outputs.conf:

[tcpout]
defaultGroup = index

[tcpout:index]
server= aaa.bbb.ccc.ddd:ppp
token = 8-4-4-4-12

When I restart the Splunk daemon, the token stays in clear in the configuration file and on the indexer, I have this log: "token not sent by forwarder!"

If I specify that without the token, the UF works very well.

Does somebody know where I'm wrong?

Bonus question: Does anyone know how the token is created (urand, ...)?

thank you a lot!

0 Karma

rdimri_splunk
Splunk Employee
Splunk Employee

Hey mvidal,
Could you double check that the token that you have put in outputs.conf is indeed a valid one. That is, it has the same value which you got when you generated on indexer.
Some key points to keep in mind.
1) Not all strings are valid tokens, they are GUID's. If it is not a valid token it will not be sent from the forwarder to indexer.
2) Your token stays in plain text because string '8-4-4-4-12' is not a valid guid, since it is not a valid token we dont even look at it from the perpective of using it or encrypting it.

Technically you should not have to care about how tokens are generated by indexer. You should treat them as opaque objects from your side.

0 Karma

ddrillic
Ultra Champion

The generation of the token and this particular error message are described at Control forwarder access

The documentation about the error message at the bottom of the page -

alt text -

0 Karma

mvidal31
Engager

Thank you for your response.

I've already checked all the documentation on this subject. I try to understand:

  • What are the real mechanisms used behind the command? When I ask to generate a token, how does it choose the token?

  • The UF don't send the token, it's right. But why?

I hope I'm more precise.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...