Dashboards & Visualizations

Unable to edit files in Lookup editor (latest version)


We are using the latest version of lookup file editor (3.4.6) and Splunk cloud version (8.1.2012.1). 

I couldn't edit/save any of the lookup files in the lookup editor. I tried uploading the .csv, but now luck. 

I get an error saying " you do not have permission", although there are no issues with the permission as I have admin rights. when I tried to change the permission (for testing), I didn't let me save it. I'm getting the below error. 

  1. Splunk could not update permissions for resource data/lookup-table-files [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "This handler does not support the 'edit' action and cannot be used for ACL modification."}.

Please suggest a remedy for this. 

Labels (2)
0 Karma


Hey @rajuloyola 
did you figure this out?

0 Karma


I am having the same issue. 

I can't edit any lookup table or create any. 

Receive the error: You do not have permission to edit this lookup file

Tags (1)
0 Karma


Added the following capability to the "admin" role


now I can edit the lookup tables. 


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>