Getting Data In

Why is Indexer Discovery on a Splunk 6.3.3 universal forwarder failing with http_response=Unauthorized?

joshuabiggley
Path Finder

We followed the documentation as specified, but when we configure the universal forwarders as specified we get the error below

02-26-2016 08:47:11.754 -0600 ERROR HttpClientRequest - Caught exception while parsing HTTP reply: Unexpected character while looking for value: '<'
02-26-2016 08:47:11.754 -0600 ERROR IndexerDiscoveryHeartbeatThread - failed heartbeat for group=splunkssl uri=https://X.X.X.X:8089/services/indexer_discovery http_response=Unauthorized

I've seen this error posted in the forums elsewhere without resolution.

We're running Splunk 6.3.3

Any thoughts?

0 Karma
1 Solution

joshuabiggley
Path Finder

Although we thought were were careful enough, we changed the /opt/splunk/etc/system/local/server.conf file so that the [general] and [indexer_discovery] stanzas both had the same pass4SymmKey. We then updated the outputs.conf on the universal forwarders in question and restarted the universal forwarder service and it worked.

I could have sworn that we followed that process previously, but we obviously borked something the first time through.

Marking as resolved.

View solution in original post

joshuabiggley
Path Finder

Although we thought were were careful enough, we changed the /opt/splunk/etc/system/local/server.conf file so that the [general] and [indexer_discovery] stanzas both had the same pass4SymmKey. We then updated the outputs.conf on the universal forwarders in question and restarted the universal forwarder service and it worked.

I could have sworn that we followed that process previously, but we obviously borked something the first time through.

Marking as resolved.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...