Splunk Search

Upgraded from 7.2.6 to 7.3.2, "upload lookup" shows 404 error

rbal_splunk
Splunk Employee
Splunk Employee

we recently upgrade our fairly large deployment of Splunk from version 7.2.6 to 7.3.2, and our users are unable to open "upload lookup" button or when trying to delete lookups..
Was there a new capability for lookups that was added?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Editing lookups now require role upload_lookup_files since Splunk Enterprise 7.3.x. This requirement has not been documented yet.When a user without role "upload_lookup_files" attempts to add or edit a lookup they are directed to the Splunk Pony - message
Documentation JIRA s in works

BUG SPL-176155:Editing lookups roles have changed Splunk 7.3.x and now require new roll upload_lookup_files (which is undocumented)"

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!