yecgz (yecgz) asked a question.
Hello,
I recently noticed that my Splunk Add-on is getting a 403 response from Okta. At first, I assumed it was because for some reason it got "behind" because it's trying to get data "since" a month ago. So I spun my wheels trying to figure out how to reset that value (no luck, can't find it). So, I asked my Okta admin to check the same URL, and he was getting data in his browser after he logged in. So, it's starting to look like a permission problem. I had my Okta admin provide a new API key, which I put into the Splunk app. It did not resolve it right away, but as I'm looking at my logs the next morning, it did finally pick up and the 403 is gone.
But it seems "stuck" still trying to get logs from a month ago, and only writing 60k logs every hour. The URL still has the same "since=" value. Is that right? Isn't there a way to reset that? Any help would be appreciated.
Hi there! Apologies for the lack of response to your question. Going forward, we're implementing a new process to ensure that all Discussions receive a response from either another Community member or from the Okta Support team within 7 days of posting. Thank you for your patience while we put this into action!
I know this question is a bit old now, but If you’re still looking for information or help I’d recommend reaching out to the fine folks in the Admin Pro Tips group to see if anyone there can help: https://support.okta.com/help/s/group/0F90Z000000EK23SAG/admin-pro-tips
Thanks 🙂