topic vectra integration in Getting Data In

vectra integration

aly347774 — Sun, 04 Feb 2024 11:47:30 GMT

when I go to search head to change configuration of TA_vectra_detect_json I find this (You do not have permissions to edit this configuration.)

Re: vectra integration

Richfez — Mon, 05 Feb 2024 20:24:23 GMT

That specific error is usually caused by you having a Search Head Cluster, then trying to edit configs on a Search Head Member instead of via the Deployer then deploying it.

See this for more information.

https://docs.splunk.com/Documentation/Splunk/9.2.0/DistSearch/PropagateSHCconfigurationchanges

If that does not seem to be the problem here, then reply back with a few more specifics!

Re: vectra integration

aly347774 — Tue, 06 Feb 2024 06:57:43 GMT

When I go to SearchHead to edit, it tells me this message (You do not have permissions to edit this configuration)

Re: vectra integration

Richfez — Tue, 06 Feb 2024 13:37:56 GMT

Yes. IF you have a search head cluster (shc), AND you are trying to edit the config on one of the members instead of on the deployer, THEN that's exactly the message I expect you to get.

It *might* be possible to get that if you simply don't have some permission or another that's required, but I think those messages are different ones.

So - Do you have a search head cluster?

If you don't know, then ask your Splunk folks and/or have them manage this config for you.

If you are the Splunk person and don't know what I'm saying (and you built it) then you don't have a SHC and we'll have to look into other things.

(Also, please be careful as to *which* "reply" button you click, so we can keep the threads going correctly instead of being willy-nilly all over the place!)