topic Re: Splunk Manager Admin Permission Problem in Security

Splunk Manager Admin Permission Problem

harald_leitl — Mon, 16 Jul 2012 12:54:57 GMT

Hi,

Just updated my search heads to 4.3 and now I get following message when trying to create new roles in Splunk manager.

There was an error retrieving the configuration, can not process this page.

You do not have permission to access the configuration for this page.

No difference between LDAP user (with admin privilege) and local Admin user, both receive the same error.

my /opt/splunk/etc/apps/search/metadata/default.meta shows:

....

*[manager/authentication_roles]

access = read : [ admin ], write : [ admin ]*

...

that should be okay.

Any suggestion?

thanks,

harry

Re: Splunk Manager Admin Permission Problem

lguinn2 — Mon, 16 Jul 2012 18:54:29 GMT

Sometimes I see errors like this if Splunk was started/stopped by root, when it normally runs as a different user. Some of the files become owned by root and then odd things don't work. In Linux, there is a simple fix. Assuming that

Splunk is installed in /opt/splunk
Splunk should run as user splunkit
you are signed in as a user with sudo privileges

cd /opt sudo chown -R splunkit splunk

Of course, the problem could be something entirely different...

Re: Splunk Manager Admin Permission Problem

harald_leitl — Thu, 30 Aug 2012 08:28:01 GMT

just chanced permissions - unfortunately still the same behavior.

Re: Splunk Manager Admin Permission Problem

harald_leitl — Wed, 28 Nov 2012 10:00:08 GMT

any other suggestion? could it be a bug?