Hello, since upgrade 9.4.11 from 9.3.0 getting error 500 on splunkweb using local user (works with admin account). The user works fine from CLI using API but I wanted to try a query on splunkweb.
Tried to recreate same role with limited capabilities and user on another platform and working fine, on same version.
/OPT/splunk/etc/system/local/authorize.conf
[role_monitoring]
get_diag = enabled
get_metadata = enabled
get_typeahead = enabled
rest_access_server_endpoints = enabled
rest_properties_get = enabled
search = enabled
srchIndexesAllowed = _*;linux;oxygene_cmdb;windows
srchJobsQuota = 9
srchMaxTime = 1800
srchTimeEarliest = -1
srchTimeWin = -1
Thanks.