topic Getting an error in checking authentication.conf in Getting Data In

Getting an error in checking authentication.conf

gekoner — Thu, 29 Nov 2012 23:49:51 GMT

We are getting the following error on one of our Search Heads.
Splunk ver = 4.2.3
This happens when we run the "splunk btool check --debug" command.
Any ideas what we messed up? I think this is a bug.

Possible typo in stanza [roleMap] in /opt/splunk/etc/.... line **: user = SplunkAdmin

Re: Getting an error in checking authentication.conf

seanwong — Fri, 30 Nov 2012 00:12:05 GMT

It sounds to me like you have defined a custom group called SplunkAdmin with a specific privilege level that "user" is assigned to.

Can you check your authorize.conf and see if stanza along the lines of
[role_SplunkAdmin]

Did this happen after a splunk upgrade? If it did, you may want to open up a case with splunk and get a splunkdiag going.

Re: Getting an error in checking authentication.conf

gekoner — Fri, 30 Nov 2012 00:27:20 GMT

I do not have a [role_SplunkAdmin] entry in authorize.conf
This didn't happen after an upgrade perse, but this might have been an issue since we upgraded to 4.2.x

Isn't the issue with the [roleMap] syntax?