I'm getting a 401 Unauthorized error no matter what I try, when trying to access the REST API. I've tried with curl and via regular web browser, same error. I tried using the admin account, I tried creating a new account and a new role which has the following REST capabilities:
This new account's username and password is standard, no special characters.
curl -u restapi:password -k https://testserver:8089/services/search/jobs -d search="search *"
But I've also tried assigning the admin role and all the other capabilities. Nothing works. I get this error everytime. Is there something else that I need to set in Splunk? This is driving me bananas at this stage. We have a fully licencse on-side Splunk instance, but I am using the unlicensed latest version in a test environment.
Thanks for any help
This shows something is already listening on port 8089 so Splunk probably asked on startup if you'd like to use another port and chose the next available 8090.
Do you have a Splunk universal forwarder installed too?
I have it installed on Windows Server 2012. What would the command be on that? The guy who found the solution to change the port in the command might have also changed the port in the server settings, so I'm asking and will let you know. Either way, there was still a problem with 8089
Thanks jkcat. The only capability that I could find with the word "tok" in it was "request_remote_tok", and enabling that didn't make a difference. Am I missing something? Also I changed the password from default, that didn't make a difference, either. Still getting the same 401 Unauthorized error