Splunk Search

Why is a user getting error "Cannot overwrite existing app object" trying to change lookup table permissions from private to app in a search head cluster?


We are using a search head cluster and we are having an issue with the following workflow. A user has lookup table that is private. The user is trying to change permissions for the lookup table from private to app. The following error appears:

Splunk could not update permissions for resource data/lookup-table-files [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

I have tried global as well with no change.

Any ideas?


Hi ebailey,

check if there is any other lookup table with the same name already in the App and shared within this App or in any App in your SHC that shares the lookup globally.

Hope this helps ...

cheers, MuS


na - i removed it from shcluster and then ran the cluster push to command to tell the cluster the file was no longer present.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...