Broken Pipe issues when adding new data source to Splunk from GUI

[dshakespeare_sp]

Customer reports that when trying to upload a local file to Splunk (Add Data -> From files and directories -> Upload and index a file -> Save), Splunk reports "Success! Your data is being indexed to Splunk". However, the uploaded file is not available at the selected index. At the server side, i see this log entry at the second when clicking "Save":

splunkd.log
WARN HttpListener - Socket error from 127.0.0.1 while accessing /services/receivers/stream: Broken pipe

[dshakespeare_sp · Accepted solution]

The issue was seen for non admin users that tried to add data to Splunk. By adding the "edit_tcp" capability to the users role, the error disappeared and uploaded data gets indexed.