louislam/uptime-kuma · error · Error

Splunk notification failed with status code ${result.status}

Error message

Splunk notification failed with status code ${result.status}

What it means

Thrown by Splunk.checkResult when result.status exists but falls outside the 2xx success range. Splunk's Event Collector / On-Call REST endpoint returns 2xx on accepted events; anything else (401, 403, 400, 5xx) means the payload was rejected or the endpoint is misconfigured.

Source

Thrown at server/notification-providers/splunk.js:49

                return this.postNotification(notification, title, heartbeatJSON.msg, monitorJSON, "trigger");
            }
        } catch (error) {
            this.throwGeneralAxiosError(error);
        }
    }

    /**
     * Check if result is successful, result code should be in range 2xx
     * @param {object} result Axios response object
     * @returns {void}
     * @throws {Error} The status code is not in range 2xx
     */
    checkResult(result) {
        if (result.status == null) {
            throw new Error("Splunk notification failed with invalid response!");
        }
        if (result.status < 200 || result.status >= 300) {
            throw new Error("Splunk notification failed with status code " + result.status);
        }
    }

    /**
     * Send the message
     * @param {BeanModel} notification Message title
     * @param {string} title Message title
     * @param {string} body Message
     * @param {object} monitorInfo Monitor details (For Up/Down only)
     * @param {?string} eventAction Action event for PagerDuty (trigger, acknowledge, resolve)
     * @returns {Promise<string>} Success state
     */
    async postNotification(notification, title, body, monitorInfo, eventAction = "trigger") {
        let monitorUrl;
        if (monitorInfo.type === "port") {
            monitorUrl = monitorInfo.hostname;
            if (monitorInfo.port) {
                monitorUrl += ":" + monitorInfo.port;

View on GitHub (pinned to 6b5ea01557)

Solutions

  1. Verify notification.splunkRestURL ends with the correct HEC path (typically /services/collector/event or the Splunk On-Call REST endpoint).
  2. Regenerate and re-paste the Splunk token; HEC tokens are shown once.
  3. In Splunk, confirm the HEC token is enabled and the index is allowed for it (Settings > Data Inputs > HTTP Event Collector).
  4. Reproduce the POST with curl -H 'Authorization: Splunk <token>' to see Splunk's detailed error body.
Defensive patterns

Strategy: validation

Validate before calling

// Validate URL + token shape before posting to Splunk
function buildSplunkOptions(notification) {
    if (!notification.splunkRestURL) throw new Error("Splunk REST URL is required");
    try { new URL(notification.splunkRestURL); } catch { throw new Error("splunkRestURL is not a valid URL"); }
    if (!notification.pagerdutyIntegrationKey) throw new Error("Splunk routing key is required");
    return { /* ...existing options... */ };
}

Type guard

/** True when status is in the 2xx success band. */
function is2xx(status) {
    return typeof status === "number" && status >= 200 && status < 300;
}

Try / catch

try {
    const result = await axios.request(options);
    if (!is2xx(result?.status)) {
        throw new Error(`Splunk notification failed with status code ${result?.status}`);
    }
} catch (err) {
    this.throwGeneralAxiosError(err);
}

Prevention

When it happens

Trigger: Wrong or expired Splunk token (401/403), incorrect splunkRestURL pointing at a non-event-collector path (404), malformed event body (400), Splunk server down (5xx), or network proxy returning 502/504.

Common situations: splunkRestURL copied from the Splunk UI without the /services/collector path, token regenerated in Splunk but not updated here, or HEC disabled for the token.

Related errors

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/c9cd8cae5b441ad5. Report an issue: GitHub.