Splunk Enterprise

Why is dashboard returning "Action Forbidden." only for certain users?

j_irving
Engager

I have a dashboard that only for some users (seems to be some new ones or long returning ones), is returning an "Action Forbidden." error message on panels. I have checked access permissions, but there are no differences to other users who are not receiving this error. I have also checked the enterprise docs, but can't find reference to this error message.

Dashboard Panel error message below.

j_irving_0-1659340942609.png

Any help would be appreciated

0 Karma

j_irving
Engager

Thanks for your response,
I've tested on an account with the exact same permissions, also other users within the same user group are not presenting the same issue.

The prevailing theory is that it is part of the search head configuration isn't replicating  properly across the cluster, we have attempted to repair with a manual resync. We don't have a way to confirm though, as we've been unable to replicate the issue.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

how you have check user's access rights? If you are just looking those from user settings, simple rest query or with btool from conf files you usually not get correct rights. The reason for this is that may times there are lot of different places where those rights has set and then splunk combines those together to get the real rights for user.

This is one app https://splunkbase.splunk.com/app/4111/ which I have used to check what are real rights for users. Maybe not perfect but at least I have found and merged/fixed some issues with it. There are some other apps & REST examples which you can use to figure out the situation on your environment.

r. Ismo

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...