Getting 403 Error with SolarWinds to Splunk Integration using Splunk Add-on for Solarwinds

I am collecting SolarWinds logs using the Splunk add-on for SolarWinds but a few days ago the i stopped receiving data in splunk. I checked the splunk internal logs and I am getting the following 403 error message.

There has been no changes on SW recently that could cause this. Any ideas what could be wrong and how to resolve this?

2024-08-28 04:56:17,504 +0000 log_level=ERROR, pid=20250, tid=Thread-4, file=engine.py, func_name=_send_request, code_line_no=318 | [stanza_name="Splunk_SolarWinds_Alerts"] The response status=403 for request which url=xxx.xx.xx:17774/.../Json/Query?query=SELECT+EventID,EventTime,NetworkNode,NetObjectID,NetObjectValue,EngineID,EventType,Message,Acknowledged,NetObjectType,TimeStamp,DisplayName,Description,InstanceType,Uri,InstanceSiteId+FROM+Orion.Events+WHERE+EventTime>'2024-08-27T18:11:24.1830000' and method=GET.

Find more posts tagged with

Alert

splunk

Alerts

API

Accepted answers

All comments

LeBeauUK

403 is access denied might want to check usernames and passwords. Also if you are using SolarWinds API and recently upgraded check that you have got 17774 set to request access as 17778 is disabled by default.

BenAgbettor

Thank you. it turns out our SW team made some changes to the service account we we used for the authentication. we changed the service account and re-authenticated and that resolved the issue. we changed the port to 17774 when SW was upgraded couple of months back.