3.0.5: output:splunk: Error http_status=401 Token is required

[nehjain17]

With 3.0.5 getting below error.
[2024/05/24 05:47:13] [ warn] [output:splunk:splunk.16] http_status=401:
{"text":"Token is required","code":2}

[edsiper]

Please provide your full configuration

[nehjain17]

output plugin

[OUTPUT]
Name splunk
Match index1
event_index index1
host splunk_host_name
Port 443
splunk_token ${TOKEN}
tls On
tls.verify Off
Retry_Limit 5
net.connect_timeout 30
net.keepalive on

[rchopd]

we are also facing same issue... 3.0.4 had lot of warning noise so upgraded to 3.0.5 which gave us "Token is required" error, despite of providing splunk_token in output config
@edsiper can you please take a look at it.

[2024/05/24 22:02:24] [debug] [output:splunk:splunk.0] Could not find hec_token in metadata
[2024/05/24 22:02:24] [debug] [output:splunk:splunk.0] Could not find hec_token in metadata
[2024/05/24 22:02:24] [debug] [output:splunk:splunk.0] Could not find hec_token in metadata
[2024/05/24 22:02:24] [debug] [http_client] not using http_proxy for header
[2024/05/24 22:02:24] [ warn] [output:splunk:splunk.0] http_status=401:
{"text":"Token is required","code":2}

[edsiper]

I am looking into this.

[edsiper]

I have pushed #8873 to fix this issue.

[rchopd]

Hey @edsiper
Thanks for fixing the issue. Will it be available in 3.0.5 or you are going to create a new tag?

[edsiper]

@rchopd v3.0.6 has been pushed, packages and images will be available in a couple of hours.

[rchopd]

Thanks a lot.. will test it once available and let you know our findings

[soc-team-members]

We are using v3.1.9, but we are still (or again?) getting these debug messages, even though we did specify a valid splunk_token.

[2024/11/08 11:26:48] [debug] [output:splunk:splunk.1] Could not find hec_token in metadata