topic Re: Possible bug with changing permission on source based field extraction in Security

Possible bug with changing permission on source based field extraction

knielsen — Sun, 07 Jun 2020 17:28:46 GMT

Hello,

I just ran into the issue that I couldn't change the permission of a source based field extraction via GUI on 7.3.1.

This only happens for source based field extrations, sourcetype ones are not affected.

Clicking on the "Permissions" Link in Sharing results in an error like this:

Splunk could not retrieve permissions for resource data/props/extractions [HTTP 404] https://127.0.0.1:8089/servicesNS/kainiels/search/data/props/extractions/source%253A%253A%252Fvar%252Flog%252Fbar%20%3A%20EXTRACT-foo?safe_encoding=1; [{'type': 'ERROR', 'text': 'Could not find object id=source%3A%3A/var/log/bar : EXTRACT-foo', 'code': None}]

Can someone confirm that issue, or is our installation maybe broken somehow? I didn't see this mentioned in the release notes of later versions...

Re: Possible bug with changing permission on source based field extraction

darius_diederic — Thu, 13 Feb 2020 13:11:34 GMT

I have the same problem with version 7.2.9.1. It appears to me that this error occurs for any field extraction that contains a forward slash /. Did happen to get any confirmation this is a bug?

Re: Possible bug with changing permission on source based field extraction

kaurinko — Thu, 30 Apr 2020 08:59:09 GMT

I have the same problem with 8.0.1. Would be interested to know if there is a solution.

Re: Possible bug with changing permission on source based field extraction

kaurinko — Thu, 30 Apr 2020 09:04:00 GMT

I can confirm, that this only happens for source based field extractions. Ones with sourcetype-based searches are not affected.

Re: Possible bug with changing permission on source based field extraction

darius_diederic — Thu, 30 Apr 2020 12:31:30 GMT

I received word from developers this bug will be fixed on version 7.2.11, 7.3.6 and 8.0.4 with a release date of 05/12/2020.

Re: Possible bug with changing permission on source based field extraction

dbot2001 — Mon, 15 Jun 2020 19:08:06 GMT

Is there a workaround for this?