Splunk Observability Cloud

Trying to use the Splunk OTEL collector on Linux, TOKEN is not working

jeffa2
Explorer

I'm trying to follow these instructions:
https://github.com/signalfx/splunk-otel-collector/blob/main/docs/getting-started/linux-installer.md

...I set up a Splunk trial, and have copied a new token that I created with all read accesses.  I am using the UI here:

app.us1.signalfx.com

When I use the token from the UI that I got from General Settings -> Access Tokens to perform an action with the script I downloaded from the instructions, I get an error.  I run this:

sh splunk-otel-collector.sh --realm us1

Here are the results:

$ sh splunk-otel-collector.sh --realm us1
Please enter your Splunk access token: BHwgwl0s32kbI227gUzORw
Splunk OpenTelemetry Collector Version: latest
Memory Size in MIB: 512
Realm: us1
Ingest Endpoint: https://ingest.us1.signalfx.com
API Endpoint: https://api.us1.signalfx.com
Trace Endpoint: https://ingest.us1.signalfx.com/v2/trace
HEC Endpoint: https://ingest.us1.signalfx.com/v1/log
TD Agent (Fluentd) Version: 4.3.2

Your access token could not be verified. This may be due to a network connectivity issue or an invalid access token.

.......any idea what could be going wrong??

Thank you!!
Jeff

 

Labels (1)
0 Karma
1 Solution

bishida
Splunk Employee
Splunk Employee

Nice! Yes, I meant "ingest" but wrote "access", but you still figured it out 😉

View solution in original post

Sam2103
New Member

Hi, I am also facing the same issue, could you please help in this?

0 Karma

bishida
Splunk Employee
Splunk Employee

Hi,

Can you confirm you're using a token with "INGEST" capability? Note, the "default" token will have "INGEST" and "API" capabilities, so you should be fine if you use the default token.

0 Karma

jeffa2
Explorer

I'm using an access token...  I get it from the UI at General Settings -> Access Tokens.  Here's a screenshot:

access_token.png

0 Karma

jeffa2
Explorer

oh wait, I think I see what you're saying!  I changed to ingest token and it's working now... thank you!!!

0 Karma

bishida
Splunk Employee
Splunk Employee

Nice! Yes, I meant "ingest" but wrote "access", but you still figured it out 😉

bishida
Splunk Employee
Splunk Employee

Oh, by the way--please be sure to make yourself a new token and delete the old ones since the ones you were experimenting with got posted publicly here. Anyone could mess with your instance. 

jeffa2
Explorer

I revoked right after posting 😉  thank you for the help with this!!

0 Karma

bishida
Splunk Employee
Splunk Employee

Hi,

Did you perhaps create and try to use an API token? If so, try using an access token. 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...