Splunk IT Service Intelligence

ITSI - capability \"execute-notable_event_action\

abarneb
Explorer

I'm seeing a lot of these errors regarding the capability \"execute-notable_event_action:

2017-03-10T16:08:52,445 ERROR [itsiruleengine-akka.actor.default-dispatcher-8] EventOperations:599 - HTTP 403 -- {"message":"(403, '\"splunk-system-user\" does not have the capability \"execute-notable_event_action\"')"}

/opt/splunk/etc/apps/itsi/default/authorize.conf:

Notable Event actions

read-notable_event_action = enabled
execute-notable_event_action = enabled

If I try to assign a notable event nothing happens, so I suspect that this is related. My user has the ito_admin/analyst/user roles granted.

Many thanks in advance 🙂

Tags (2)
0 Karma
1 Solution

abarneb
Explorer

The issue was resolved after having granting the ITSI roles to the admin role.

View solution in original post

0 Karma

abarneb
Explorer

The issue was resolved after having granting the ITSI roles to the admin role.

0 Karma

abarneb
Explorer

Turned out that the admin role was lacking the itsi roles. The error disappreared after having granted these roles.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...