After upgrading from Splunk 5.0.4 to 6.2.1, why am I getting Forbidden permissions access errors trying to edit some saved searches from a custom app?

[trishmad]

I just upgraded from Splunk 5.0.4 to 6.2.1 and am getting the following error when I try to edit a saved search from App. This occurs on some, but not all saved searches.

http 403 error : Forbidden You don't have permission to access /en/US/app/custome_app_name/search on this server.

[bjoernjensen]

You might want to look under which user splunkd is running and how this users privileges match for the directories / files of those apps that do not behave well.

In Linux you could start with:
ps -Af | grep splunkd | grep -v grep

and then look who can do what with the all apps main directories:
ls -la $SPLUNK_HOME$/etc/apps

or drill it down to a specific file:
find $SPLUNK_HOME$/etc/apps/*/*/savedsearches.conf -exec ls -la {} \;

Cheerz - B

Edit

Maybe this helps: http://answers.splunk.com/answering/222327/view.html

[trishmad]

Forbidden You don't have permission to access /en-US/app/custome_app_name/search on this server