topic Re: rest command without admin account in Getting Data In

rest command without admin account

thielethomas — Mon, 26 Jun 2017 10:32:06 GMT

Hi,

which role rights are necessary for using the rest command (http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Rest#Syntax) in splunk searches ?

The search is just working with an admin account at the moment. When using power user account, I get:

REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/deployment/server/clients?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.
Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/deployment/server/clients?count=0 from server=https://127.0.0.1:8089 - Forbidden

I already added all rest rights to poweruser role (rest_*).

Re: rest command without admin account

maciep — Sun, 02 Jul 2017 12:57:17 GMT

I could be mistaken, but I think the user would need to have access to whatever objects they're trying to access via rest. For example, can your power user log on to that Splunk instance and get to Forwarder Management manually (looks like you're trying to hit the deployment server)?

Re: rest command without admin account

thielethomas — Tue, 29 Sep 2020 14:53:45 GMT

Hi maciep,

thanks for your hint !!!
I had to add "list_deployment_client" & "list_deployment_server" in order to get my dashboard working.