topic Re: Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor) in Getting Data In

Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

czervos — Tue, 29 Sep 2020 23:09:09 GMT

When I try to add data to the main index via the REST API utilizing the upload.py python script in the splunk-sdk git I get the following error

do not have permission to perform this operation (requires capability: edit_monitor).

even though I am using the API as an administrator (sc_admin) user role.

Following this I inspected the capabilities under sc_admin and sure enough edit_monitor is not a capability that the sc_admin has.

So I said OK let me add the capability. Unfortunately, the capability can not be added to the user role. What am I missing here?

I know a suggested work around is to use the forwarder to upload the data but is this an admission that one can not add data to the index via the REST api?

The exact same python script works like a charm with the Enterprise Splunk instance.

Re: Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

chrisyounger — Mon, 04 Feb 2019 20:03:36 GMT

You need to get support to open access to the API

More info here: https://answers.splunk.com/answers/432240/i-am-a-splunk-cloud-customer-i-would-like-access-t.html

Re: Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

czervos — Mon, 04 Feb 2019 23:49:20 GMT

Chrisyoungerjds, access to the API is open. When I curl to

curl -k -u username:password https://.splunkcloud.com:8089/servicesNS/nobody/search/properties/props/websphere_core

gives a response just fine.

It is when I try to upload a log file via the REST API that I get the error below.

File "/usr/local/lib/python2.7/site-packages/splunklib/binding.py", line 1244, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 403 Forbidden -- You (user=username) do not have permission to perform this operation (requires capability: edit_monitor).

Re: Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

chrisyounger — Mon, 04 Feb 2019 23:57:47 GMT

OK - Sorry I am not sure how to get that specific role added.