From 9dcf361f262b6a4f013dfa4c1e04be63f786e46a Mon Sep 17 00:00:00 2001
From: Emilia Voicu <emilia.voicu95@gmail.com>
Date: Tue, 15 Oct 2019 09:27:03 +0000
Subject: [PATCH] add logging for invalid/expired splunk tokens

---
 hubblestack/hec/obj.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hubblestack/hec/obj.py b/hubblestack/hec/obj.py
index 28e269807..4ad985082 100644
--- a/hubblestack/hec/obj.py
+++ b/hubblestack/hec/obj.py
@@ -427,6 +427,9 @@ def _send(self, *payload, **kwargs):
                 possible_queue = True
                 # If Splunk said it doesn't want this message, increment the opinion counter
                 meta_data['bad_request'] += 1
+            elif r.status == 403:
+                log.error('invalid or expired token (%d %s)', r.status, r.reason)
+                possible_queue = True
 
         # if we get here and something above thinks a queue is a good idea
         # then queue it! \o/