Splunk Search

Rest API - Returning 401 Unauthorized

scriv
Explorer

I'm getting a 401 Unauthorized error no matter what I try, when trying to access the REST API. I've tried with curl and via regular web browser, same error. I tried using the admin account, I tried creating a new account and a new role which has the following REST capabilities:
rest_apps_management
rest_apps_view
rest_properties_get
rest_properties_set

This new account's username and password is standard, no special characters.

curl -u restapi:password -k https://testserver:8089/services/search/jobs -d search="search *"

But I've also tried assigning the admin role and all the other capabilities. Nothing works. I get this error everytime. Is there something else that I need to set in Splunk? This is driving me bananas at this stage. We have a fully licencse on-side Splunk instance, but I am using the unlicensed latest version in a test environment.

Thanks for any help
Sean

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

This shows something is already listening on port 8089 so Splunk probably asked on startup if you'd like to use another port and chose the next available 8090.

Do you have a Splunk universal forwarder installed too?

scriv
Explorer

Nope, no universal forwarder in this dev environment - the fact that it is working now is that main thing, but thanks for all your help!

0 Karma

scriv
Explorer

Not sure why, but the solution to this problem was to change the port to 8090!!

curl -u restapi:password -k https://testserver:8090/services/search/jobs -d search="search *"

Why would this be?

0 Karma

jkat54
SplunkTrust
SplunkTrust

I guess you've changed the SplunkD port somehow.

0 Karma

scriv
Explorer

I don't believe I did. I had no reason to at all.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Can you post the output of this?

netstat -an | grep 808
0 Karma

jkat54
SplunkTrust
SplunkTrust

Also this

ps -ef | grep 808
0 Karma

scriv
Explorer

I have it installed on Windows Server 2012. What would the command be on that? The guy who found the solution to change the port in the command might have also changed the port in the server settings, so I'm asking and will let you know. Either way, there was still a problem with 8089

0 Karma

scriv
Explorer

It was just the port in the command that was changed to 8090 - nothing on the server was changed

0 Karma

jkat54
SplunkTrust
SplunkTrust

netstat -an | findstr :808

Please

0 Karma

scriv
Explorer

netstat -an | findstr :808
TCP 0.0.0.0:8088 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8089 0.0.0.0:0 LISTENING

0 Karma

jkat54
SplunkTrust
SplunkTrust

ok so maybe in iptables you route port 8090 to 8089?

0 Karma

jkat54
SplunkTrust
SplunkTrust

They also need the rest "tok" capabilities AND you must change the default admin password from changeme to something else.

0 Karma

scriv
Explorer

Thanks jkcat. The only capability that I could find with the word "tok" in it was "request_remote_tok", and enabling that didn't make a difference. Am I missing something? Also I changed the password from default, that didn't make a difference, either. Still getting the same 401 Unauthorized error

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is there a proxy server configured on your host you're testing from?

Are you using splunk free or splunk lite?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please provide the output of this ran from a command prompt:

netstat -an | findstr :808

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!