Getting Data In

Why is Indexer Discovery on a Splunk 6.3.3 universal forwarder failing with http_response=Unauthorized?

Path Finder

We followed the documentation as specified, but when we configure the universal forwarders as specified we get the error below

02-26-2016 08:47:11.754 -0600 ERROR HttpClientRequest - Caught exception while parsing HTTP reply: Unexpected character while looking for value: '<'
02-26-2016 08:47:11.754 -0600 ERROR IndexerDiscoveryHeartbeatThread - failed heartbeat for group=splunkssl uri=https://X.X.X.X:8089/services/indexer_discovery http_response=Unauthorized

I've seen this error posted in the forums elsewhere without resolution.

We're running Splunk 6.3.3

Any thoughts?

0 Karma
1 Solution

Path Finder

Although we thought were were careful enough, we changed the /opt/splunk/etc/system/local/server.conf file so that the [general] and [indexer_discovery] stanzas both had the same pass4SymmKey. We then updated the outputs.conf on the universal forwarders in question and restarted the universal forwarder service and it worked.

I could have sworn that we followed that process previously, but we obviously borked something the first time through.

Marking as resolved.

View solution in original post

Path Finder

Although we thought were were careful enough, we changed the /opt/splunk/etc/system/local/server.conf file so that the [general] and [indexer_discovery] stanzas both had the same pass4SymmKey. We then updated the outputs.conf on the universal forwarders in question and restarted the universal forwarder service and it worked.

I could have sworn that we followed that process previously, but we obviously borked something the first time through.

Marking as resolved.

View solution in original post