I'm trying to run the app version 2.0 on Splunk 7.3.3 on Windows Server 2016. Even as Admin I always get the error 'read'. In the instructions this is referred as a known issue if the permissions are insufficient. I had no problems on Linux, is there an issue with Splunk on Windows?
Thanks to the help of a colleague we found the solution:
| rest /services/apps/local
| table title eai:acl.perms.read
find the app(s) with no read permission and correct it
Thanks to the help of a colleague we found the solution:
| rest /services/apps/local
| table title eai:acl.perms.read
find the app(s) with no read permission and correct it
It seems to be because an app has no read permission set. I found it by searching the request (/services/apps/local?output_mode=json&count=0) and for an app without read. Then set read permission and it works
The same issue is happening on OS X as well. I was not able to test the solution on windows servers, but I simulate the issue in my local Splunk Enterprise running on OS X and it had fixed the issue. I am not able to find where the permission issues are on OS X, I re-apply the permissions on Mac, but it did not fix the issue.
What I did to get this correct working, I did a back from etc folder, remove Splunk Enterprise, reboot the server and Install Splunk Enterprise, Splunk Platform Upgrade Readiness App and it had worked.
Check this answer -> https://answers.splunk.com/answers/786636/splunk-platform-upgrade-readiness-app-on-os-x.html
The errors I get on the Windows installation are not very useful
2019-12-03 09:26:35,223 INFO 5596 - Handling a request
2019-12-03 09:26:35,240 INFO 5596 - Executing function, name=get_read_progress
2019-12-03 09:26:38,609 INFO 5596 - Handling a request
2019-12-03 09:26:38,609 INFO 5596 - Executing function, name=get_app_list
2019-12-03 09:26:38,641 ERROR 5596 - Failed to handle request due to an unhandled exception
Traceback (most recent call last):
File "D:\Splunk\etc\apps\upgrade_readiness_app\bin\app_list.py", line 118, in handle
return function_to_call(scan_type)
File "D:\Splunk\etc\apps\upgrade_readiness_app\bin\app_list.py", line 161, in get_app_list
user_app_list = self.get_user_apps(content_role, content_apps)
File "D:\Splunk\etc\apps\upgrade_readiness_app\bin\app_list.py", line 231, in get_user_apps
read_permission = app['acl']['perms']['read']
KeyError: 'read'