Unable to make REST API call with token authentication.

Applicability

Description

The requirement was to retrieve data using the REST method with bearer token authentication to Splunk Cloud. However, the cURL command was returning 401 unauthorized errors when it was being executed.

However, it was functioning properly for simple authentication, such as allowing users to retrieve data from Splunk Cloud simply by entering the username and password in the cURL command. 

Investigation

1. Confirmed that REST API is enabled on the Splunk Cloud environment.

2. Verified if IP addresses are permitted in the IP allow list.

3. After further investigation, the below errors were found in the internal index:

ERROR JsonWebToken [3810679 TcpChannelThread] - JsonWebToken validation failed because: Token 'token-value' cannot be used before: Sun Jul  7 11:15:29 2024

4. After verifying the authenticity of the token established for authentication, by navigating to Settings > Tokens and click on the token, the 'NOT BEFORE' value was set to the following month. This indicated that the token created for authentication cannot be used until the NOT BEFORE time has passed.

Resolution

Determine when the token will be used, enter the value or date in the "Not Before" column, and then generate the token if a "Not Before" variable is required.

Related Links

Create authentication tokens

Use cURL to manage HTTP Event Collector tokens, events, and services