Inability to Write to Lookup FIle

[LukeMurphey]

The PCI app is producing errors indicating that the lookup files could not be written. Below is an example of the error:

[SimpleResultsTable module] Server
reported HTTP status=400 while getting
mode=results <?xml version='1.0'
encoding='UTF-8'?>

type='FATAL'>Error in
'outputlookup' command:
Could not write to file
'account_history_tracker.csv'.

How do I fix this issue?

[LukeMurphey · Accepted solution]

Root Cause:

The issue is due to the fact that the lookup files are not writable. The PCI needs to be able to update the lookup files in order to function.

Solution:

To fix the issue, set the permissions on the lookup files to allow them to be writable by the account that Splunk is running under. The lookup files that need to be adjusted are available under the lookup directory of the following apps:

• SplunkPCIComplianceSuite ($SPLUNK_HOME/etc/apps/SplunkPCIComplianceSuite/lookups)
• PCI-Requirement11 ($SPLUNK_HOME/etc/apps/PCI-Requirement11/lookups)