Getting Data In

splunk-reskit-powershell 401

inicholson
Engager

I'm using splunk-reskit-powershell to access splunk, but running "Connect-Splunk -Credentials $credentials -ComputerName "$computername"" causes powershell to throw an error: "Invoke-HTTPPost : Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (401) Unauthorized.""
What rights do I need in order to authenticate correctly?

Tags (1)
1 Solution

halr9000
Motivator

401 is very simply an authentication error. So, this means one of the connection parameters are incorrect. Try running it with the -Verbose flag and if you look at the first several lines, you'll see it restate all of the connection parameters. For example:

VERBOSE: Performing operation "Connecting to port 8089 using protocol https with timeout 10000 (ms)" on Target "bd-idx-01.bd.splunk.com".

Double-check that the server, port, and protocol are correct. Also make sure that the credentials which you are supplying work against your Splunk instance.

The credentials that you supply need to have the same rights as what you expect to see when you connect. If you have an admin account, try that just to rule that out as an issue. I just tested a non-admin account and was able to connect to my search head, but not an indexer, so take that into consideration.

View solution in original post

E17769
New Member

Thanks That works for me. Also, I included my domain name in my user id
EX:
$userName = Me@domain.com

Changed it to
$userName = Me

and it worked after that... It's always the little things

0 Karma

halr9000
Motivator

401 is very simply an authentication error. So, this means one of the connection parameters are incorrect. Try running it with the -Verbose flag and if you look at the first several lines, you'll see it restate all of the connection parameters. For example:

VERBOSE: Performing operation "Connecting to port 8089 using protocol https with timeout 10000 (ms)" on Target "bd-idx-01.bd.splunk.com".

Double-check that the server, port, and protocol are correct. Also make sure that the credentials which you are supplying work against your Splunk instance.

The credentials that you supply need to have the same rights as what you expect to see when you connect. If you have an admin account, try that just to rule that out as an issue. I just tested a non-admin account and was able to connect to my search head, but not an indexer, so take that into consideration.

piebob
Splunk Employee
Splunk Employee

in the future, if the answer is correct/solves your problem, please accept the answer by clicking the checkmark (i've done it for you). thanks!

0 Karma

inicholson
Engager

Figured it out! I was trying to authenticate with "username$domain.tld", but splunk was expecting "username".

0 Karma

E17769
New Member

Thanks the helped me. I included my domain name in my user name and that was the issue.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...