Splunk App for VMware: Why am I receiving an "insufficient access" error when I am an admin?

[aniello_cerrato]

Hi,

I have installed Splunk Enterprise version and I have added the app VMWare. When I click on VMWare app and I try to configure it (configuration tab) I have the following error:

Insufficient Access
You are trying to modify a page that you do not have access to, please contact your splunk administrator for more assistance.

I am the administrator of windows machine.

Thanks,
Aniello Cerrato

[aniello_cerrato · Accepted solution]

Hi,

I have solved the problem re-installing all app, I have downloaded it directly the .zip and not using install app from splunk.

Thanks,
Aniello

[maraman_splunk]

Hi

just add the same pb !
looking into the app, I found out the following :
- apps require adding splunk_vmware_admin role to your user
- this doesn't work if you edit admin profile and add splunk_vmware_admin as inheritance

So edit user admin and add splunk_vmware_admin role (no need to unlog, just reload the page after)

to debug :
search for index=_internal source="/Applications/splunk643/splunk/var/log/splunk/splunk_for_vmware_setup.log"

to see the offending function :
Splunk_TA_vmware/appserver/controllers/splunk_for_vmware_setup.py
scroll to function def isValidAdmin(user=None, session_key=None):
check is :
if 'splunk_vmware_admin' in roles:

Hope that helps !

[aniello_cerrato]

The problem is this, I have installed the VMWare application but I haven't WMWare app in my dashboard but I have SA-Threshold app.

When i try to open this app I have the error:

You are trying to modify a page that you do not have access to, please contact your splunk administrator for more assistance

I have also tried to re-install app but I have the below error:

[HTTP 500] [HTTP 409] App "SA-Threshold" already exists; use the "-update true" argument to install anyway

Could you help me to solve this problem?

Thanks,
Aniello

[maraman_splunk]

Hi,

the pb I had similar to you was on a DCN node (Data Collection Node) , not a search head, so I had not vmware app on it.
As stated by the table in http://docs.splunk.com/Documentation/AddOns/released/VMW/Installationoverview , you should have installed splunk_for_vmware on your search head.
SA-apps are supporting add ons, not sure you should be able to see something visible in SA-threshold as it's probably used in the background by splunk_for_vmware app.

[aniello_cerrato]

Hi,

I have a little problem, I don't find splunk_vmware_admin in the roles.

Thanks,
Aniello

[maraman_splunk]

strange. it's defined there :
etc/apps/Splunk_TA_vmware/default/authorize.conf:[role_splunk_vmware_admin]
you have deployed Splunk_TA_vmware v3.3.0 ?