Security

WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

qjvtenkroode
Explorer

I'm getting this warning on my search peers. After some digging around (and trying this on some brand spanking new setups) I found out it has something to do with Splunk calling services/admin/auth-keys and not getting an appropriate response back. But I'm still baffled why, at first I thought I misconfigured something but after doing a test setup with just one search head and one search peer I get the same issue. This makes me doubt if this is "working as intended" or something else..

Any ideas anyone?

Tags (1)

lakshman237
Path Finder

Hopefully this resolved by now. This usually appears when the search head cannot authenticate with search peers in the distributed environment. Pls re-authenticate either using CLI or from the GUI within the search head : settings-> distributed search -> Search peers and ensure, its up and enabled.

0 Karma

jonathon
Path Finder

I'm getting these too across 64 indexers and am trying to determine what's causing it. I've walked through all of the my search peers and haven't found one with bad keys yet.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...