About anil19

anil19 · ‎10-12-2021

Hi @willsy Greetings, I'm new to Splunk. Even we are having similar error on few HF "Error in Indexer Discovery communication" in an clustered environment. But there other HF in same cluster behaving normally. Recently, we updated/renewed SSL certificates on forwarding tier, indexing tier and on search tier.

anil19 · ‎08-02-2021

Dear Splunkers, If I could get an answer on how do I find which HEC token is causing authentication failures (num_of_auth_failures=1) from _introspection logs, will very much helpful. I'm using below query to find the errors, but how do I pin point which is causing the issue? index=_introspection component=TERM(HttpEventCollector) "data.series"=TERM(http_event_collector) (data.num_of_auth_failures=1 OR data.num_of_requests_to_disabled_token=1 OR data.num_of_requests_to_incorrect_url=1) Thanks in Advance.

Posts	2
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎03-10-2021

Online Status	Offline
Date Last Visited	‎03-08-2024 05:04 AM

HEC Token Authentication Failures

Re: The TCP output processor has paused the data f...

HEC Token Authentication Failures