https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80437#M20324 <P>That took care if it, thank you. Mine was set to False. I can now access my data. </P> <P>Should the conf files all have the version of the current Splunk install? My web.conf listed 4.3.1 (I've gone through several upgrades on this machine).</P> Thu, 03 Oct 2013 00:43:37 GMT DaClyde 2013-10-03T00:43:37Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80435#M20322 <P>I get the following error for all of my searches after upgrading from 5.0.4 to 6.0:</P> <P>Write access to the proxy endpoint is disabled. </P> <P>Anyone have any idea what this means? I'm just running on a standalone Win7 machine, no forwarders or anything exotic involved.</P> Wed, 02 Oct 2013 21:11:23 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80435#M20322 DaClyde 2013-10-02T21:11:23Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80436#M20323 <P>That error comes up if write access to the proxy endpoint is explicitly denied. In web.conf there is a setting enable_proxy_write that needs to be set to True. </P> <P>The default setting that ships with Splunk is True. Check etc/system/local/web.conf and see if it is being set to False.</P> <P>The reason that you are seeing this in Splunk 6 and not in Splunk 5 is that we've moved almost all of the logic and rendering for the search app into the browser. It communicates with splunkd through the proxy endpoint in splunkweb.</P> Mon, 28 Sep 2020 14:52:59 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80436#M20323 arobbins_splunk 2020-09-28T14:52:59Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80437#M20324 <P>That took care if it, thank you. Mine was set to False. I can now access my data. </P> <P>Should the conf files all have the version of the current Splunk install? My web.conf listed 4.3.1 (I've gone through several upgrades on this machine).</P> Thu, 03 Oct 2013 00:43:37 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80437#M20324 DaClyde 2013-10-03T00:43:37Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80438#M20325 <P>You may be getting out of my comfort-zone, but I don't think we query the conf files for the version info (at least not now). Can you copy/paste the part of your web.conf that lists that version? (or, is this a filesystem meta-data version, in which case it may not have been updated since the original install)</P> Thu, 03 Oct 2013 00:48:00 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80438#M20325 arobbins_splunk 2013-10-03T00:48:00Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80439#M20326 <P>From the top of the file:</P> <P>Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved. Version 4.3.1<BR /> DO NOT EDIT THIS FILE!<BR /> Please make all changes to files in $SPLUNK_HOME/etc/system/local.<BR /> To make changes, copy the section/stanza you want to change from $SPLUNK_HOME/etc/system/default<BR /> into ../local and edit there.</P> <P>This file contains possible attributes and values you can use to configure Splunk's web interface.</P> Mon, 28 Sep 2020 14:53:02 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80439#M20326 DaClyde 2020-09-28T14:53:02Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80440#M20327 <P>Let me check with our qa/support team to see if this is expected behavior in an upgrade scenario. A fresh install would have Version 6.0 at the top of the file.</P> Thu, 03 Oct 2013 01:47:03 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80440#M20327 arobbins_splunk 2013-10-03T01:47:03Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80441#M20328 <P>The headers of configuration files are not read by Splunk.</P> <P>The presence of this header in <CODE>$SPLUNK_HOME/etc/system/local/web.conf</CODE> is abnormal and seems to indicate that someone has copied <CODE>$SPLUNK_HOME/etc/system/default/web.conf</CODE>to that location. This is not a good idea, as it prevents changes brought by Splunk upgrades in the default web.conf to take effect.</P> <P>I would recommend to review the contents of the local version of web.conf and to retain only the things you've changed locally. You should <EM>not</EM> have a full copy of the default web.conf in the local directory.</P> Thu, 03 Oct 2013 02:22:39 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80441#M20328 hexx 2013-10-03T02:22:39Z https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80442#M20329 <P>Thank you, I'll get my files cleaned up and keep an eye on that in the future. Now I understand the "DO NOT EDIT THIS FILE!" warning. I didn't think it made sense given the context.</P> Thu, 03 Oct 2013 15:00:52 GMT https://community.splunk.com/t5/Splunk-Search/quot-Write-access-to-the-proxy-endpoint-is-disabled-quot-for-any/m-p/80442#M20329 DaClyde 2013-10-03T15:00:52Z