Deployment Architecture

What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved?

ksoucy
Path Finder

User receives the following authorization error when trying to access extractions that they just created and saved:
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS//search/properties/app?fillcontents=1

Admin user verifies the extractions exist, and they do work/apply when the user is searching data in Splunk Web. However the user who created and "owns" the extraction can not access the Settings>Fields> section to see them.

Users role capabilities are (paste is from authorize.conf, but roles were created in splunk web):
admin_all_objects = enabled
change_own_password = enabled
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
get_metadata = enabled
pattern_detect = enabled
schedule_search = enabled
search = enabled
search_process_config_refresh = enabled
srchIndexesAllowed = lvmv
srchIndexesDefault = lvmv
srchMaxTime = 0

Descriptions of capabilities in Splunk docs are too high level to be of real help.

1 Solution

ksoucy
Path Finder

Resolved, by adding one capability at a time and testing (eliminating those capabilities that are obviously not involved - like system-level stuff). Turns out its the "rest_properties_get" capability. I never would have guessed this from the description of the capabilty in the docs: rest_properties_get Can get information from the services/properties endpoint.

View solution in original post

ksoucy
Path Finder

Resolved, by adding one capability at a time and testing (eliminating those capabilities that are obviously not involved - like system-level stuff). Turns out its the "rest_properties_get" capability. I never would have guessed this from the description of the capabilty in the docs: rest_properties_get Can get information from the services/properties endpoint.

hhGA
Communicator

Hi,

Have you tried the edit_sourcetypes capability?

0 Karma

ksoucy
Path Finder

FYI - users id was removed from the URL posted above, but it appears between the "//"

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...