All Apps and Add-ons

500 Internal Server Error with EMC Isilon Add-on for Splunk Enterprise. What user account and group configuration is required?

hmatthews_splun
Splunk Employee
Splunk Employee

Hi,

The Isilon account configured within the Isilon TA was generating a “..403 …Forbidden..” error and since adding the account to the audit:admin group, it's now erroring with "500 Internal Server Error".

Please can you advise what user account and group configuration is required within the Isilon config?

Thank you.

0 Karma

gorla
New Member

Hello Folks,

Good day!

We are in similar situation. The account with above privileges able to pull the audit logs from Isilon? Please confirm.

Must appreciated your help. Thanks

0 Karma

pdoconnell
Path Finder

This is what we currently have configured for our user:

Privileges                  Read/write access 
ISI_PRIV_LOGIN_CONSOLE      N/A 
ISI_PRIV_LOGIN_PAPI             N/A 
ISI_PRIV_LOGIN_SSH          N/A 
ISI_PRIV_ANTIVIRUS          Read-only 
ISI_PRIV_AUDIT              Read-only 
ISI_PRIV_CLUSTER            Read-only 
ISI_PRIV_DEVICES                Read-only 
ISI_PRIV_EVENT              Read-only 
ISI_PRIV_FTP                    Read-only 
ISI_PRIV_HDFS               Read-only 
ISI_PRIV_HTTP               Read-only 
ISI_PRIV_ISCSI              Read-only 
ISI_PRIV_JOB_ENGINE             Read-only 
ISI_PRIV_LICENSE                Read-only 
SI_PRIV_NDMP                Read-only 
ISI_PRIV_NETWORK            Read-only 
ISI_PRIV_NFS                    Read-only 
ISI_PRIV_NTP                Read-only 
ISI_PRIV_QUOTA              Read-only 
ISI_PRIV_REMOTE_SUPPORT     Read-only 
ISI_PRIV_SMARTPOOLS         Read-only 
ISI_PRIV_SMB                Read-only 
ISI_PRIV_SNAPSHOT           Read-only 
ISI_PRIV_STATISTICS             Read-only 
ISI_PRIV_SYNCIQ                 Read-only 
ISI_PRIV_VCENTER            Read-only 
ISI_PRIV_WORM               Read-only 
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...