We have recently added the app Demisto Add-on for Splunk (TA-Demisto 2.0.4). When ever we try to add the IP and the API to the app and save it we get the following error in Splunk.
Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/TA-Demisto/apps/local/TA-Demisto/setup: ('The read operation timed out',)",)
When checking the splunk server we are seeing the following error as well:
08-19-2019 21:02:47.396 +0000 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 595, in execute\n if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)\n File "/opt/splunk/etc/apps/TA-Demisto/bin/demisto_setup.py", line 535, in handleEdit\n postargs=post_args)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 536, in simpleRequest\n raise splunk.AuthorizationFailed(extendedMessages=uri)\nAuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/messages\n
Has anyone seen this error before?
Thanks,
Curt
