topic Re: Splunk could not update permissions for resource data/transforms/lookups in Security

Splunk could not update permissions for resource data/transforms/lookups

joy76 — Mon, 24 Dec 2012 07:18:50 GMT

I tried to change in permissions from private to Global of lookup table and definition- and automatic lookups- in 2 indexers and header server.
(There are 3 splunks(Linux Redhat 6.3). 2 indexers(2 servers physically) and 1 header(1 server physically).)
There show no problem in 2 indexers, but the header servers shows the following error messages:

"Splunk could not update permissions for resource data/transforms/lookups [HTTP 409][{'text':'Cannot overwrite existing app object','code':None, 'type':'ERROR'}] "

What would you suggest to solve this problem or error?

Re: Splunk could not update permissions for resource data/transforms/lookups

paul_1994 — Wed, 13 Mar 2013 12:39:40 GMT

I just ran into this issue too. Can anyone explain why this happens..

FOr me i added a extraction to props.conf and I get this error when trying to change permission on the new extraction

Re: Splunk could not update permissions for resource data/transforms/lookups

aarcro — Tue, 30 Apr 2013 13:58:04 GMT

Experiencing this today trying to change permissions from private to global on a saved search.

Re: Splunk could not update permissions for resource data/transforms/lookups

mookiie2005 — Thu, 01 Aug 2013 15:35:43 GMT

I am also getting this error can anyone help?

Re: Splunk could not update permissions for resource data/transforms/lookups

mookiie2005 — Thu, 01 Aug 2013 15:40:32 GMT

I just had this issue and I found that we had two instances of the same field extraction from two different users. If you tried to make one global you would not have an issue when you try and make the second, of the same name, global you receive the error described above. Hope this helps someone else.

Re: Splunk could not update permissions for resource data/transforms/lookups

joy76 — Thu, 08 Aug 2013 04:22:57 GMT

Thanks for your help.

Re: Splunk could not update permissions for resource data/transforms/lookups

neelamssantosh — Thu, 10 Jul 2014 11:27:52 GMT

similar problem with permission modification / update for tags.

in Tags » List by field value pair i was getting --Private | Permissions unable to update to Global
but

in Tags » All unique tag objects, it was showing --Global | Permissions

I ran to update the tags.conf with
http(s)://yoursplunkhost:8000/debug/refresh?entity=admin/fvtags

Give app level permissions:
1. In /opt/splunk/etc/apps/xx/metadata
access = read : [ * ], write : [ admin,power ]
export = system
OR
2. From Apps drop down apps--> manage Apps.
select the respective app and give global permission and u are there.

Re: Splunk could not update permissions for resource data/transforms/lookups

tmnuclear — Wed, 22 Apr 2015 07:38:02 GMT

I had the same error for a view I created. I couldn't set it to App/Global from Private. Also, the metadata didn't include any rule of the view, which was placed in an app. I moved it to a different App and then I was able to change the permissions as it is supposed to be

Re: Splunk could not update permissions for resource data/transforms/lookups

stephenoleary — Tue, 08 Oct 2019 11:30:02 GMT

Brilliant, thanks, would be helpful if splunk actually said what the problem was rather than just failing with Error=None

Re: Splunk could not update permissions for resource data/transforms/lookups

yshen — Fri, 13 Aug 2021 18:12:46 GMT

For the record, I ran into a case, when I run into the error message.
It was when I needed to replace an existing csv file for lookup.

I forgot to delete the existing one, and hoping the new file will override the existing one.

It turned out that Splunk just complained without clearer indication of my offense.

It would have been more helpful with more concrete error diagnose.