1Password scripted inputs remain disabled. Local app reload times out after reinstall with token storage error

Available Languages

Updated:October 3, 2026
Document ID:SPLK055292

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

All three data types—sign-in attempts, item usage events, and audit events—are affected. The app configuration page fails on Submit with the error: "Something went wrong while storing your token - please try again." The three scripted inputs remain disabled with no start time. The Splunk Web console reports a timeout error connecting to the local app reload endpoint. A direct request to the reload endpoint takes approximately 94 seconds. Restarting Splunk Cloud and reinstalling the 1Password app did not resolve the issue. Attempts to enable scripted inputs via REST failed due to missing edit_scripted capability. The issue is linked to the splunkdConnectionTimeout setting being too low.


Investigation

1. Confirm the scripted inputs are disabled and have no start time.
2. Observe the error message on the app configuration page during token submission.
3. Check Splunk Web console logs for splunkd daemon timeout errors related to local app reload.
4. Measure the time taken for local app reload requests; expect long delays (~94 seconds).
5. Verify the current splunkdConnectionTimeout value in web.conf under [settings]; default is 30 seconds.
6. Confirm that the 1Password app version 1.15.1 is installed and compatible with Splunk Cloud 10.5.2605.6.
7. Validate that new API tokens with required scopes are generated and configured.
8. Check if scripted inputs can be enabled via REST API and verify required capabilities.


Resolution

1. Increase splunkdConnectionTimeout to 600 seconds in the web.conf file under the [settings] stanza.

[settings]
splunkdConnectionTimeout = 600

The setting will be changed in the local folder (e.g., $SPLUNK_HOME/etc/system/local/web.conf).

2. The Splunk Cloud search head will be restarted to apply the configuration change.
3. Retry submitting the 1Password Events API token in the app configuration page.
4. Verify that the three scripted inputs are enabled and running.
5. Confirm that new 1Password events are ingested successfully.
6. If scripted inputs remain disabled, check for the edit_scripted capability and enable it if necessary.
7. Coordinate with 1Password support if further setup assistance is needed.


1Password Events Reporting for Splunk app

1Password Support

CCAB-5608 Configuration Change Approval

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles