Error: SplunkApi.Logoff()

Products

• Information Centric Analytics

Issue/Introduction

Splunk data source query jobs fail and log any of the following errors in the SplunkImporterSplunkResultsDriven_<job-ID>.<yyyyMMdd>.log file:

[1:ERROR] SplunkApi.Logoff() Error while executing Logoff

[1:ERROR] Program.Main() Splunk.Client.UnauthorizedAccessException: 403: Forbidden

Error: You (user=<username>) do not have permission to perform this operation (requires capability: edit_httpauths).

The Splunk importer log is located on the server hosting the Splunk import utility (typically the SQL Server host) and stored in the following path:

%SystemDrive%\ProgramData\BayDynamics\Logs

Environment

Release : 6.x

Component : Splunk Import Utility

Cause

This error is returned when the setting Logoff After Job Completion is enabled in the data source query configuration and the Splunk API account lacks the privilege edit_httpauths on the Splunk server.

Resolution

To resolve this error, either disable the setting Logoff After Job Completion in the data source query configuration or grant the privilege edit_httpauths to the API account in Splunk.

Additional Information

In ICA 6.5.3.0 and earlier versions, the logoff command was controlled by this setting in the file SplunkImporter.exe.config:

<add key="Splunk.Authentication.DoLogoff" value="False" />

The configuration file is stored in the same folder as the SplunkImporter.exe executable as part of ICA's Database Utilities. These are installed by default on the SQL Server host in the following path:

%SystemDrive%\Program Files\Bay Dynamics\Database Utilities

The Splunk importer is located in the subfolder \Splunk

Beginning with 6.5.4, the Splunk.Authentication.DoLogoff key is set in the data source query editor page in the Risk Fabric console. This setting is enabled by default, which may differ from the value set in the configuration file used with older versions of the importer.