topic Re: Downloading lookup files via API returning 403 Forbidden in Reporting

Downloading lookup files via API returning 403 Forbidden

random_event — Fri, 20 Oct 2023 17:06:52 GMT

I just updated the Splunk App for Lookup File Editing to the latest and now I can no longer download lookup files via CLI. This has been working flawlessly in Splunk Cloud when I was running v3.6.0 but just updated to 4.0.1 (v4.0.2 not available in Cloud yet) and now I am getting 403 errors.

Through testing, I verified lookup endpoint is still valid, lookup shared at global level, and I even changed the permissions of the account to be sc_admin but still experiencing the same issue. Has anyone else come across this and found a solution? Same error no matter which lookup file I attempt to download.

My test command

python3 lut.py -app search -l geo_attr_countries.csv -app search INFO:root:list of lookups to download: ['geo_attr_countries.csv'] ERROR:root:[failed] Error: Downloading file: 'geo_attr_countries.csv', status:403, reason:Forbidden, url:https://[REDACTED].splunkcloud.com:8089/services/data/lookup_edit/lookup_contents?lookup_type=csv&namespace=search&lookup_file=geo_attr_countries.csv

Python script from here

Re: Downloading lookup files via API returning 403 Forbidden

dsanders80 — Wed, 06 Dec 2023 21:12:48 GMT

You need to supply the owner in your call. Just add "&owner=nobody" if it is a global lookup.

Re: Downloading lookup files via API returning 403 Forbidden

PTC_ — Thu, 28 Mar 2024 11:01:21 GMT

Was the issue fixed?
I'm having the exactly same issue and weeks ago it was working fine.

No change was done to the lookup/dataset permissions and the user I'm using to access is the owner of the lookup.

Could this be related to a splunk certificate being expired?
or something else?

Re: Downloading lookup files via API returning 403 Forbidden

random_event — Thu, 28 Mar 2024 13:21:42 GMT

Unfortunately, I never found a solution. If you happen to find the fix, please reply with it.