Splunk Search

Why is a user getting error "Cannot overwrite existing app object" trying to change lookup table permissions from private to app in a search head cluster?

ebailey
Communicator

We are using a search head cluster and we are having an issue with the following workflow. A user has lookup table that is private. The user is trying to change permissions for the lookup table from private to app. The following error appears:

Splunk could not update permissions for resource data/lookup-table-files [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

I have tried global as well with no change.

Any ideas?

MuS
SplunkTrust
SplunkTrust

Hi ebailey,

check if there is any other lookup table with the same name already in the App and shared within this App or in any App in your SHC that shares the lookup globally.

Hope this helps ...

cheers, MuS

ebaileytu
Communicator

na - i removed it from shcluster and then ran the cluster push to command to tell the cluster the file was no longer present.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.