Splunk refused a request with HTTP {status} ...

Warnings reference › source.splunk.failed

Identifier

source.splunk.failed

Raised by

The grid (core)

Since

1.78.0

What happened

A request came back with an HTTP status other than 401/403 (a refused token) or 404 on a job's own endpoint (an ordinary TTL expiry), and Splunk's response body carried a messages list explaining why - an exhausted search-artifact quota, a malformed search, an internal error. The call is thrown either way; this names the reason Splunk gave rather than leaving only the status code to go on.

The fix

Read the detail: it is usually Splunk's own diagnosis (a role's disk quota, a bad search) rather than something the adapter can retry around on its own.

The smallest fix

splunkAdapter({ url, search }); // a 503 with a quota message now names it

Reference

Covered in full at the API reference.