Splunk Search

Upgraded from 7.2.6 to 7.3.2, "upload lookup" shows 404 error

rbal_splunk
Splunk Employee
Splunk Employee

we recently upgrade our fairly large deployment of Splunk from version 7.2.6 to 7.3.2, and our users are unable to open "upload lookup" button or when trying to delete lookups..
Was there a new capability for lookups that was added?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Editing lookups now require role upload_lookup_files since Splunk Enterprise 7.3.x. This requirement has not been documented yet.When a user without role "upload_lookup_files" attempts to add or edit a lookup they are directed to the Splunk Pony - message
Documentation JIRA s in works

BUG SPL-176155:Editing lookups roles have changed Splunk 7.3.x and now require new roll upload_lookup_files (which is undocumented)"

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...