Splunk® Enterprise

Securing Splunk Enterprise

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Troubleshoot token authentication

If a token fails authentication for any reason, the Splunk platform writes a message to splunkd.log with additional information. As a Splunk administrator, you can read this log file to get information on why authentication with the token failed.

For additional information, you can enable debug logging on Splunk Enterprise instances only. Splunk Enterprise writes information about token authentication using the JsonWebTokenHandler tag. See Enable debug logging for instructions. After you have enabled debug logging, look for this tag when you review logs for information on problems that occur with token authentication.

Common problems for token authentication

Following are a list of common problems that can occur with token authentication.

Splunk platform instance displays "Token authentication is disabled"

If you receive this error message, either in Splunk Web or through a REST command, it means that you have not enabled token authentication.

cURL command returns "call not properly authenticated"

This message means that authentication to the Splunk platform instance with the token you presented was not successful.

  • Confirm that the token is enabled. If it is not, and it has not yet expired, enable it if you have permission, or contact your administrator.
  • Confirm that the token is valid and has not expired. If it has expired, create a new one if you have permission, or contact your administrator. You cannot extend token validity.
  • Confirm that the "Not before" validity time for the token has passed. If it hasn't, either wait or create a new token if you have permission.
  • Confirm that the token has not been deleted. If it has, create a new one if you have permission.
  • Confirm that the account that is associated with the token exists. If it doesn't, create one, then create a new token and assign that user to the token, if you have permission.
  • Confirm that you use the full token as it was generated. If you don't have the full token, request or create a new one, if you have permission.
  • Confirm that you are using a token on the same Splunk platform instance where it was issued.
  • If your Splunk platform instance uses an LDAP server for authentication, confirm that the user exists and is not disabled on LDAP server.
  • If your Splunk instance uses an LDAP server for authentication, confirm that the instance can connect to the LDAP server.

Error received "KV store not ready"

This message means that app key value store (KV store) has not been enabled. Enable KV store if you have permission, or contact your administrator.

Last modified on 22 October, 2021
Use authentication tokens   About single sign-on using reverse proxy

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters