topic Re: User is not allowed to modify the job error in Getting Data In

Why is User is not allowed to modify the job error?

kakawun — Wed, 30 Aug 2023 16:08:00 GMT

Hi all. One of our users cannot upload files to splunk with the error "User is not allowed to modify the job".

The user is a power user but not an admin user.

May I know if we need to amend any settings for it to work? Thanks.

Re: User is not allowed to modify the job error

kamlesh_vaghela — Fri, 07 Jul 2023 07:04:25 GMT

@kakawun

Can you please check the logged-in user's role and capabilities sufficient to write data?

Re: User is not allowed to modify the job error

PickleRick — Fri, 07 Jul 2023 07:51:11 GMT

Well, normally that's not something you grant a normal user with. Especially that usually data onboarding is either done directly on forwarders or via apps distributed from DS - it's relatively uncommon for production search-heads to do ingestion on their own.

Ayway, the most probable candidate for the capability you need would be edit_monitor, but it allows for much more than just uploading a data file for ingestion.

Re: User is not allowed to modify the job error

isoutamo — Fri, 07 Jul 2023 08:44:00 GMT

I confirm that @PickleRick is 100% right. You should never add data directly on your production environment by some regular user. Actually not even any admin users!

Your onboarding process should contains instructions how users set up they developer splunk instances to do that data onboarding and then how admins will deploy ready TA/Apps to production via git or other repository.

r. Ismo

Re: User is not allowed to modify the job error

kakawun — Fri, 07 Jul 2023 08:44:42 GMT

Thanks for your advice. We have already granted the user with the edit_monitor capability but unfortunately it is not working.

Re: User is not allowed to modify the job error

kakawun — Fri, 07 Jul 2023 08:48:00 GMT

The user has been assigned with Power role (https://docs.splunk.com/Documentation/Splunk/9.0.5/Security/Rolesandcapabilities) with the below addition capabilities:

edit_monitor
indexes_edit
edit_tcp

Thanks.

Re: User is not allowed to modify the job error

patrickvanreck — Wed, 30 Aug 2023 12:19:49 GMT

Hi,
I tried to add the capabilities listed above, but the user get still the same answer back as before:
User is not allowed to modify the job

Re: Why is User is not allowed to modify the job error?

JohnMurphyAus — Fri, 15 Sep 2023 02:14:27 GMT

We have also started getting this issue after updating Splunk from 8.2 to 9.1.
When I change user role to Admin, they can upload data, when I change back to previous role with the mentioned permissions, they get the same error "User is not allowed to modify the job".

This must be a change in one of the roles in the update, but I'm just trying to figure out which permission is needed for this. My user has the following permissions which is what I read is required to add data:

edit_monitor
indexes_edit
edit_tcp
search

But still no luck. Will update if I find the specific permission required.

Re: Why is User is not allowed to modify the job error?

kakawun — Fri, 15 Sep 2023 02:41:31 GMT

I have opened a case and the Splunk Engineering confirmed that there is a bug due to a code change since 9.0.5 version.

The workaround for now is to assign the user with "admin_all_objects" but it is very similar to administrative privileges.

Re: Why is User is not allowed to modify the job error?

JohnMurphyAus — Fri, 15 Sep 2023 06:23:51 GMT

Thanks @kakawun this worked. Happy to give users this temporarily. Hopefully Splunk will rectify this bug soon. If you can mark your own comment as an answer I would recommend that! Thanks again.

Re: User is not allowed to modify the job error

patrickvanreck — Fri, 15 Sep 2023 08:45:13 GMT

I agree, but in some cases it makes sense to give a single user the ability to upload logs to a dedicated index (eg. siem detection usecases).

I had to give Admin rights to the server, and that was not the way I wanted to set the permissions.

Kind Regards

Patrick

Re: User is not allowed to modify the job error

jvarner92 — Tue, 18 Jun 2024 18:53:18 GMT

the missing role is admin_all_objects

Re: Why is User is not allowed to modify the job error?

abell — Fri, 23 May 2025 05:40:56 GMT

Hi @kakawun ! 👋

Whilst this issue is from a while ago, it may help other users. Just wanted to let you know this issue is resolved now in 9.3.0 and later releases! 👍

If any reference to this fix is needed with support, you can quote SPL-251796.

Thanks! 😎