Security

Splunk could not update permissions for resource data/transforms/lookups

Path Finder

I tried to change in permissions from private to Global of lookup table and definition- and automatic lookups- in 2 indexers and header server.
(There are 3 splunks(Linux Redhat 6.3). 2 indexers(2 servers physically) and 1 header(1 server physically).)
There show no problem in 2 indexers, but the header servers shows the following error messages:

"Splunk could not update permissions for resource data/transforms/lookups [HTTP 409][{'text':'Cannot overwrite existing app object','code':None, 'type':'ERROR'}] "

What would you suggest to solve this problem or error?

Tags (1)

Explorer

I had the same error for a view I created. I couldn't set it to App/Global from Private. Also, the metadata didn't include any rule of the view, which was placed in an app. I moved it to a different App and then I was able to change the permissions as it is supposed to be

0 Karma

Contributor

similar problem with permission modification / update for tags.

in Tags » List by field value pair i was getting --Private | Permissions unable to update to Global
but

in Tags » All unique tag objects, it was showing --Global | Permissions

I ran to update the tags.conf with
http(s)://yoursplunkhost:8000/debug/refresh?entity=admin/fvtags

Give app level permissions:
1. In /opt/splunk/etc/apps/xx/metadata
access = read : [ * ], write : [ admin,power ]
export = system
OR
2. From Apps drop down apps--> manage Apps.
select the respective app and give global permission and u are there.

0 Karma

Communicator

I just had this issue and I found that we had two instances of the same field extraction from two different users. If you tried to make one global you would not have an issue when you try and make the second, of the same name, global you receive the error described above. Hope this helps someone else.

Path Finder

Thanks for your help.

0 Karma

Explorer

Brilliant, thanks, would be helpful if splunk actually said what the problem was rather than just failing with Error=None

0 Karma

Communicator

I am also getting this error can anyone help?

0 Karma

Explorer

Experiencing this today trying to change permissions from private to global on a saved search.

0 Karma

Path Finder

I just ran into this issue too. Can anyone explain why this happens..

FOr me i added a extraction to props.conf and I get this error when trying to change permission on the new extraction

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!