Unable to access Splunk Observability Cloud via Unified Identity - 401 error on login

Applicability

Splunk Application Performance Monitoring Splunk Cloud Platform version 10.4.2604.8 Splunk Observability Cloud (all realms) Unified Identity enabled

Description

Users are able to log into Splunk Cloud successfully. When they click the Observability Cloud link, select "Sign in via Splunk Cloud", or attempt to log in directly to Splunk Observability Cloud, the login fails with a 401 error.

 

All login methods to Splunk Observability Cloud fail simultaneously for all users on the organisation. Splunk Cloud authentication continues to work without issue.

 

A HAR capture shows a 401 response on:

 

GET /v2/session/oidc/init

 

 

 

Investigation

1. Confirm the issue affects all users

 

Verify whether the 401 error on login affects all users on the organisation simultaneously, or only specific users. If all users are affected at the same time, this points to an organisation-level configuration or platform issue rather than a per-user provisioning problem.

 

 

2. Confirm Splunk Cloud login is working

 

Verify the affected users can log into Splunk Cloud (https://<stack>.splunkcloud.com) successfully. If Splunk Cloud login also fails, investigate SAML/SSO configuration on the Splunk Cloud stack first.

 

 

3. Capture a HAR file during the failed login

 

Capture a HAR file during the failed authentication attempt and check for 401 responses. Instructions: How to generate a HAR file

 

Look for a 401 response on:

 

GET https://<org>.signalfx.com/v2/session/oidc/init

 

 

4. Confirm the issue persists in Incognito/Private mode

 

Test in Incognito or Private browsing mode to rule out cached session or cookie issues.

 

 

5. Confirm the Splunk Cloud stack version

 

Ask the Splunk Cloud administrator to confirm the Splunk Cloud Platform version. If it is 10.4.2604.8, the stack requires an upgrade — see Resolution below.

 

 

6. Confirm o11y_access role is assigned

 

Verify the affected users have the o11y_access role assigned in Splunk Cloud under:

 

Settings > Users and Authentication > Users > [username] > Assigned Roles

 

 

Resolution

Root Cause

 

A known issue in Splunk Cloud Platform version 10.4.2604.8 broke the OIDC token exchange flow between Splunk Cloud and Splunk Observability Cloud, causing the /v2/session/oidc/init endpoint to return a 401 error for all users.

 

Permanent Fix

 

Upgrade the Splunk Cloud stack to version 10.4.2604.9 or 10.5.2605.5 (or later).

 

1. Contact Splunk Support to raise an upgrade request (minimum 72 hours advance notice required).

2. Provide approval for the maintenance window.

3. After the upgrade completes, confirm users can access Splunk Observability Cloud via Unified Identity.

 

Workaround (Interim)

 

While the upgrade is being scheduled, Splunk Support can re-enable local password authentication on the Observability Cloud organisation to restore access for affected users.

 

Contact Splunk Support and request that local login be temporarily re-enabled for the affected organisation. Once enabled, users will receive an invite email to reset their password and log in locally.

 

Note: Allow up to 5 minutes for the change to take effect.

 

Revision History

Revision	Publish Date	Comments
1.0	01-Oct-2026	Initial Release