I was getting this error because the time was not synchronized on all of the search head cluster members: 09-02-2016 12:37:45.549 -0400 WARN SessionManager - Rejecting expired token generated by KR619C8B-C9D3-BB80-40FC-5F8574404AD4 because its expiration time 1468596424 is earlier than the current time 1472834265 ... View more