Troubleshoot a federated provider connection

If you are not able to get the Test Connection button to verify a connection between the federated provider and your local Splunk instance, try these troubleshooting methods.

  • Make sure you have provided correct values for the Remote Host, Service Account User Name, and Service Account Password fields. Verify that you have created a service account user for the federated provider.
  • There may be setup issues that require assistance from Splunk Customer Support, especially if you are trying to set up federated search from or to a Splunk Cloud Platform deployment. If you have a support contract, log in and file a new case using the Splunk Support Portal. Otherwise, contact Splunk Customer Support.

Avoid transparent mode lockouts

If you save a transparent mode federated provider definition with incorrect Remote Host, Service Account Username or Service Account Password information, you run the risk of being locked out of the service account by the Splunk Cloud Platform, which might remove your capability to run searches.

When the system locks your account, you have two options for unlocking it:

  • If you have administrator permissions, you can unlock the account through Splunk Web. See Unlock a user account in Splunk Web in Securing the Splunk Platform.
  • You can wait for the lockout timeout threshold to pass. When the lockout timeout threshold is reached, the system unlocks the account. The default lockout timeout threshold for the Splunk platform is 30 minutes. Your Splunk administrator may have defined a different threshold for your deployment.

Even after you unlock your account, you run the risk of being locked out again if you do not resolve the federated provider credential issue that caused the system to lock you out.