Splunk Search
Highlighted

Why is a user getting error "Cannot overwrite existing app object" trying to change lookup table permissions from private to app in a search head cluster?

Communicator

We are using a search head cluster and we are having an issue with the following workflow. A user has lookup table that is private. The user is trying to change permissions for the lookup table from private to app. The following error appears:

Splunk could not update permissions for resource data/lookup-table-files [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

I have tried global as well with no change.

Any ideas?

Highlighted

Re: Why is a user getting error "Cannot overwrite existing app object" trying to change lookup table permissions from private to app in a search head cluster?

SplunkTrust
SplunkTrust

Hi ebailey,

check if there is any other lookup table with the same name already in the App and shared within this App or in any App in your SHC that shares the lookup globally.

Hope this helps ...

cheers, MuS

Highlighted

Re: Why is a user getting error "Cannot overwrite existing app object" trying to change lookup table permissions from private to app in a search head cluster?

Communicator

na - i removed it from shcluster and then ran the cluster push to command to tell the cluster the file was no longer present.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.