WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

[qjvtenkroode]

I'm getting this warning on my search peers. After some digging around (and trying this on some brand spanking new setups) I found out it has something to do with Splunk calling services/admin/auth-keys and not getting an appropriate response back. But I'm still baffled why, at first I thought I misconfigured something but after doing a test setup with just one search head and one search peer I get the same issue. This makes me doubt if this is "working as intended" or something else..

Any ideas anyone?

[lakshman237]

Hopefully this resolved by now. This usually appears when the search head cannot authenticate with search peers in the distributed environment. Pls re-authenticate either using CLI or from the GUI within the search head : settings-> distributed search -> Search peers and ensure, its up and enabled.

[jonathon]

I'm getting these too across 64 indexers and am trying to determine what's causing it. I've walked through all of the my search peers and haven't found one with bad keys yet.