Splunk refused the token; supply a valid tok...

Warnings reference › source.splunk.auth

Identifier

source.splunk.auth

Raised by

The grid (core)

Since

1.72.0

What happened

Splunk answered a search request with 401 or 403. The call is thrown as well as named, so the grid surfaces an error rather than an empty result: a refused token that looked like "no matching events" would be the worst possible silence.

The fix

Put a valid bearer token or session key in headers, or supply a fetch that sets Authorization per request when the token expires. The adapter never stores or refreshes a credential.

The smallest fix

splunkAdapter({ url, search, headers: { Authorization: `Bearer ${token}` } });

Reference

Covered in full at the API reference.