I have a problem with the inputs stopping periodically every 3-5 days. Suspecting the JWT generation is somehow failing and the inputs gets "stuck" where its unable to sucessfully regenerate. To temporarily fix this we have to open the REST API account settings and click save to "refresh". Then everything works again until next stuck state. No change in passwords/usernames what so ever. Detailed description of the problem below: Splunk TA Remedy version: 5.7.0 Token valid and input working normally Logs show successful data collection. No 401 or 400 errors. JWT expires (~1 hour) TA attempts a refresh upon a 401 response. A new JWT is generated and saved successfully. Immediate retry is made. Failure after refresh The immediate retry fails again with 401 Unauthorized. Shortly after, every request fails with: Not able to parse Authorization Header parameter No further JWT generation occurs, even though the TA is expected to regenerate on subsequent 401s. Stuck input state Data collection stops working. Only recovery is: Removing the old jwt_token Re-saving the REST API account in the TA UI Restarting or recycling the modular input process The logs show that the TA does generate a JWT once, but after the first retry fails, the input stops regenerating tokens. Likely causes in the TA logic: In-memory account state not updated properly after token regeneration. account_info["jwt_token"] may still point to the old token used in the failing request. Refresh logic only triggers once per 401, and subsequent 401s are ignored. Token persistence in splunk_ta_remedy_account.conf is not immediately reflected in the active input process. Race condition or timeout in retry logic may corrupt the Authorization header, causing the 400 Bad request “Not able to parse Authorization Header parameter.” This explains the pattern: works normally → 1-hour expiry → 1 refresh succeeds → immediate retry fails → all future requests fail → input is stuck.
... View more