topic Re: How to provide permissions for kvstore lookups? in Splunk Search

How to provide permissions for kvstore lookups?

spyme72 — Mon, 22 Jun 2015 20:42:26 GMT

I am setting up permissions for kv store collections.
I tried to give permission in local.meta in my app for all the collections, but still getting

" Error in 'outputlookup' command: the lookup table ' permission denied for collection 'win-l1'" is invalid

Please let me know how to provide permissions for kvstore lookups.

local.meta
[lookups]
access = read : [ * ], write : [ admin, win-l1,win-l2 ]

Re: How to provide permissions for kvstore lookups?

philip_wong — Mon, 28 Sep 2020 20:28:17 GMT

I got the same problem. It didn't help to resolve the problem by adding the above local.meta.
From search.log I see the following error, surprised why admin cannot write to kvstore

07-03-2015 02:00:12.618 ERROR KVStoreLookup - Lookup failed as user 'admin' does not have access to collection 'ldap_people_kv' in app 'telco_lookups' (write: 1)

Re: How to provide permissions for kvstore lookups?

woodcock — Fri, 03 Jul 2015 16:26:03 GMT

As much as I prefer the CLI, the GUI is frequently better (harder to mess up) for setting permissions. Go to settings -> lookups and make sure that ALL 3 of your KOs (Lookup table files, Lookup definitions, and Automatic lookups) have appropriate permissions. Try "Global" first and then back down from that.

Re: How to provide permissions for kvstore lookups?

acharlieh — Fri, 03 Jul 2015 21:04:16 GMT

So it seems that using the web interface to create a KV Store creates the definition of the lookup, but does not actually create the backing collection. This causes the "lookup table "permission denied for collection 'name'" is invalid" error as opposed to just "lookup table 'name' is invalid" error that would indicate that the lookup definition doesn't exist. (I would log a support request asking for this messaging to be improved, as it's somewhat confusing.)

To resolve this, you also need to create (manually) a collections.conf stanza as described in the developer documentation to match to the target collection of your KV Store. From that doc "At a minimum, all you need to create a KV Store collection is the stanza name". I am not a KV Store expert, but you likely have to grant write access to the backing collection as well (given the error message that @philip.wong described above) in the corresponding .meta. and then restart splunk.

Re: How to provide permissions for kvstore lookups?

philip_wong — Mon, 06 Jul 2015 09:23:00 GMT

Yes, eventually I found collections.conf was missed as you said. It's fixed.
Thanks a lot!

Re: How to provide permissions for kvstore lookups?

nicolasydder — Mon, 06 Jul 2015 14:05:28 GMT

Hi spyme,

You can manage permission in local.meta (or default.meta) via the following stanza:

[collections/mycollection] access = read : [ * ], write : [ admin, win-l1,win-l2 ]

HtH,

Re: How to provide permissions for kvstore lookups?

splunk403 — Wed, 09 Nov 2016 23:45:53 GMT

If the kvstore exists and if you still facing the issue and the kvstore is created under default folder ,add access in default.meta

In default meta :

[ ]
access = read : [ * ], write : [ admin, win-l1,win-l2 ].

Hope this helps some one .

Thanks

Re: How to provide permissions for kvstore lookups?

yogesh_punia — Tue, 29 Sep 2020 12:21:58 GMT

Hi Nicolasdder

Thanks, This solution works fro my problem.
I had to provide write access to the kvstore I was only changing
[transforms/sample_kvstore]
access = read : [ * ], write : [ sample_kvstore_user, admin, power ]

Re: How to provide permissions for kvstore lookups?

markbarber21 — Wed, 28 Nov 2018 17:31:12 GMT

I am a Splunk Cloud customer who can not make configuration changes directly.
I was able to work around this by adding the backend collection via REST:

curl -k -u <username>:<password> -d name=<collections_name> https://<youraccountname>.splunkcloud.com:8089/servicesNS/nobody/<app-name>/storage/collections/config