Some pages not working after working on "Access Controls" page

[ishaanshekhar]

It was all was working fine but suddenly I see some pages are not opening.

I restarted splunkd and splunkweb but that didn't help.

All splunk processes are up and running fine on the server:
$ ./splunk status
splunkd is running (PID: 119967).
splunk helpers are running (PIDs: 119968 120009 120173 120284 120338).

Kinda weird, but could someone please help me figure out the issue?

Thanks
Ishaan

[ishaanshekhar · Accepted solution]

Solved it. Looks like defect in 6.3. It has issues while working with roles and users (may be the default roles' config changes) through GUI. It messed the account related configs.

I deleted the authorize.conf from ../etc/system/local and restarted and now it is working fine.

Thanks
Ishaan

[ishaanshekhar]

It happened in another search head!

The common thing I did was to add/edit roles/user in "Access Controls".

I am pretty sure that messed the GUI but I am not sure how and why.

I am not able to edit any dashboards either!

@richgalloway - I have attached the web_service.log.

Thanks in advance. I fear I need to reinstall splunk to make it right.

Thanks
Ishaan

[richgalloway]

What details are in web_service.log?