Splunk Security Essentials: Automated Introspection for Data Inventory Fails to Save Data

[dav2]

Hi Everyone,

we are encountering a problem with the Automated Introspection feature for Data Inventory in Splunk Security Essentials. Although the introspection process seems to runs just fine, it fails to save the data.

On the UI, there are no error messages displayed. However the introspection process does not map any data as expected. We analyzed the situation using the development console in the browser, as Splunk does not seem to provide error messages at this point in the UI. Following are the specifics of the request and the response we received:

Request Details:

• Request URL:

https://our-splunk-instance.com/servicesNS/nobody/Splunk_Security_Essentials/storage/collections/data/data_inventory_products/batch_save

• Request Method: 

POST​

• Status Code: 

403 Forbidden​

Response Message:

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">User '[username]' with roles { [role1], [role2], ... } cannot write to the collection: /nobody/Splunk_Security_Essentials/collections/data_inventory_products { read : [ * ], write : [ admin, power ] }, export: global, owner: nobody, removable: no, modtime: [timestamp]</msg>
  </messages>
</response>

The error message suggests that the user [username] does not have the necessary write permissions for the specified collection. The roles assigned to this user include [role1], [role2], ..., which appear to lack the required write access. Steps we have taken so far:

• We have reviewed the permissions settings and suspect that the issue is related to insufficient write permissions.
• We consulted the documentation on editing permissions to provide write access: Edit permissions to provide write access to Splunk Security Essentials - Splunk Documentation.

Can anyone provide guidance on any troubleshooting steps that might resolve this issue? We are particularly interested in understanding how to grant the necessary write access to the user or roles involved.

Thank you in advance for your support!

Best regards

[livehybrid]

Hi @dav2 

Your user needs to have either the "power" or "admin" role in order to be able to update that KV Store Collection.

Please check if the user has one of these roles, such as "power" and see if this resolves the issue.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing