Splunk Search

Upgraded from 7.2.6 to 7.3.2, "upload lookup" shows 404 error

rbal_splunk
Splunk Employee
Splunk Employee

we recently upgrade our fairly large deployment of Splunk from version 7.2.6 to 7.3.2, and our users are unable to open "upload lookup" button or when trying to delete lookups..
Was there a new capability for lookups that was added?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Editing lookups now require role upload_lookup_files since Splunk Enterprise 7.3.x. This requirement has not been documented yet.When a user without role "upload_lookup_files" attempts to add or edit a lookup they are directed to the Splunk Pony - message
Documentation JIRA s in works

BUG SPL-176155:Editing lookups roles have changed Splunk 7.3.x and now require new roll upload_lookup_files (which is undocumented)"

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!