topic Why can't I bump Splunk using https:///en-US/_bump and get error message "Forbidden"? in Security

Why can't I bump Splunk using https:///en-US/_bump and get error message "Forbidden"?

fdarrigo — Tue, 05 Apr 2016 14:24:31 GMT

I am trying to bump a local Splunk instance using : https:///en-US/_bump
but I receive the following:

<response> <messages> <msg type="ERROR">Forbidden</msg> </messages> </response>

This looks like an authentication/authorization error.
I am running Splunk 6.4 (Free license)

What am I doing wrong?

Rocket66 — Tue, 05 Apr 2016 14:30:55 GMT

try to got to en-US/info an hit the "Static resource cache control" - same error?
try to hit (on the same page ) "EAI object refresh"

btw.: Admin rights?

fdarrigo — Tue, 05 Apr 2016 14:37:27 GMT

same results for

en-US/info an hit the "Static resource cache control" - same error?
AND
try to hit (on the same page ) "EAI object refresh"

Since this is the free version, it doesnt support user accounts or roles, so I can't explicitly add myself to a splunk admin role.

fdarrigo — Tue, 05 Apr 2016 19:20:12 GMT

I found a work around...
Settings>Server Controls>Restart Splunk

jeffland — Wed, 06 Apr 2016 07:42:51 GMT

The free license supports neither _bump nor debug/refresh. You'll have to restart your server, as you already noted.

ppuru — Sat, 07 Jan 2017 12:24:55 GMT

Note that you also have to login before you attempt a successful bump.