Splunk Import Utility authentication failure

Products

• Information Centric Analytics

Issue/Introduction

The Splunk import utility fails to connect to the Splunk server because of an authentication error. The following error is returned by the Splunk server:

(407) Proxy Authentication Required

Environment

Release : 6.x

Cause

The Splunk server is configured to use an HTTP proxy but the Splunk data source configuration in the Information Centric Analytics (ICA) portal under Admin > Integration > Data Sources points directly to the Splunk server.

Resolution

Per Splunk's documentation regarding this error:

HTTPError: 407, Proxy Authentication Required

If you have http proxy configured, you are using unencrypted communication, and you get this error, go to Configuration > Proxy and change the Proxy Type to http_no_tunnel.