Failed to verify HMAC signature

Applicability

Splunk Enterprise 8.1.2 Splunk Enterprise 8.1.7 Splunk Enterprise 8.2.2

Description

From the license master, getting the below errors.

ERROR DigestProcessor [30127 TcpChannelThread] - Failed signature match

 

ERROR LMHttpUtil [30127 TcpChannelThread] - Failed to verify HMAC signature, uri: /services/server/health/splunkd/local?output_mode=json

 

Investigation

1. The below error is triggered in the SH cluster master, Indexer cluster master, and license master.

ERROR LMHttpUtil [30127 TcpChannelThread] - Failed to verify HMAC signature, uri: /services/server/health/splunkd/local?output_mode=json

2. Tried to add the pass4SymmKey in all the search heads under the clustering stanza in the server.conf

Example:
[clustering]
pass4symmkey = xxxxxxx

3. Verified and the pass4SymmKey is equal on search heads and also on the license master and SH cluster master server.

4. Found it is a false positive error and checked error is not affecting the Splunk environment. Affected versions are 8.1.2, 8.1.7, 8.2.1, and 8.2.2.


Root Cause

Several keys were tried for authentication and each time one fails an error was logged, even when another may succeed in authentication later on. This resulted in many "failed signature match" logs even when authentication showed as HTTP 200 success. The issue was resolved by amending the code to log the error only in the event of all keys failing.

Resolution

There will be a code fix made for this that will resolve this false error log in the future, but in the meantime, it will continue to show when the pass4symm key is present.

Ignore the error message as this is a false positive error. it will continue to show when p4sk is present. 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release