Getting Data In

Can't add data to Splunk Cloud via REST API (requires capability: edit_monitor)

czervos
Explorer

When I try to add data to the main index via the REST API utilizing the upload.py python script in the splunk-sdk git I get the following error

do not have permission to perform this operation (requires capability: edit_monitor).

even though I am using the API as an administrator (sc_admin) user role.

Following this I inspected the capabilities under sc_admin and sure enough edit_monitor is not a capability that the sc_admin has.

So I said OK let me add the capability. Unfortunately, the capability can not be added to the user role. What am I missing here?

I know a suggested work around is to use the forwarder to upload the data but is this an admission that one can not add data to the index via the REST api?

The exact same python script works like a charm with the Enterprise Splunk instance.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You need to get support to open access to the API

More info here: https://answers.splunk.com/answers/432240/i-am-a-splunk-cloud-customer-i-would-like-access-t.html

0 Karma

czervos
Explorer

Chrisyoungerjds, access to the API is open. When I curl to

curl -k -u username:password https://.splunkcloud.com:8089/servicesNS/nobody/search/properties/props/websphere_core

gives a response just fine.

It is when I try to upload a log file via the REST API that I get the error below.

File "/usr/local/lib/python2.7/site-packages/splunklib/binding.py", line 1244, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 403 Forbidden -- You (user=username) do not have permission to perform this operation (requires capability: edit_monitor).

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

OK - Sorry I am not sure how to get that specific role added.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...