Getting Data In

Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

czervos
Explorer

When I try to add data to the main index via the REST API utilizing the upload.py python script in the splunk-sdk git I get the following error

do not have permission to perform this operation (requires capability: edit_monitor).

even though I am using the API as an administrator (sc_admin) user role.

Following this I inspected the capabilities under sc_admin and sure enough edit_monitor is not a capability that the sc_admin has.

So I said OK let me add the capability. Unfortunately, the capability can not be added to the user role. What am I missing here?

I know a suggested work around is to use the forwarder to upload the data but is this an admission that one can not add data to the index via the REST api?

The exact same python script works like a charm with the Enterprise Splunk instance.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You need to get support to open access to the API

More info here: https://answers.splunk.com/answers/432240/i-am-a-splunk-cloud-customer-i-would-like-access-t.html

0 Karma

czervos
Explorer

Chrisyoungerjds, access to the API is open. When I curl to

curl -k -u username:password https://.splunkcloud.com:8089/servicesNS/nobody/search/properties/props/websphere_core

gives a response just fine.

It is when I try to upload a log file via the REST API that I get the error below.

File "/usr/local/lib/python2.7/site-packages/splunklib/binding.py", line 1244, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 403 Forbidden -- You (user=username) do not have permission to perform this operation (requires capability: edit_monitor).

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

OK - Sorry I am not sure how to get that specific role added.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...