hi everybody, i used this request with the user rest-api-reportingweb , i want write ine a kvstore lookup: | makeresults | eval Category = "HOST Blacklist" | eval activation = "09/15/21" | eval target = "Un test ajout" | eval url = "http://www.test.html" | eval tester = "*test.html*" | eval key=Category.tester.target | table key,Category,activation,target,tester,url | outputlookup t_PROXY_lookup append=True override_if_empty=false key_field=key i have this error : Error in 'outputlookup' command: Lookup failed for collection 'Condition_List_Mcafee' in app 'Splunk_For_Cnaf_Secuteams' for user 'rest-api-reportingweb': User 'rest-api-reportingweb' with roles { rest-api-reportingweb, si_cnaf, user, wan } cannot write: /nobody/Splunk_For_Cnaf_Secuteams/collections/Condition_List_Mcafee { read : [ * ], write : [ admin, power ] }, owner: adm0-ahuli755, removable: no, modtime: 1614188730.883726000. I give permissions in lookup definitions for this user i cant for lookup file beause for kvstore file dont appear. app/local/collections.conf : [Condition_List_Mcafee] field.Category = string field.activation = string field.target = string field.tester = string field.url = string replicate = true app/local/transforms.conf : [t_PROXY_lookup] external_type = kvstore collection = Condition_List_Mcafee case_sensitive_match = true match_type = WILDCARD(tester) fields_list = _key,Category,url,activation,target,tester app/metadata/local.meta [transforms/t_PROXY_lookup] access = read : [ * ], write : [ admin, power, rest-api-reportingweb ] export = system owner = nobody version = 7.3.3 modtime = 1632255805.643188000 app/lookups/lookup_file_backups/Splunk_For_Cnaf_Secuteams/nobody i dont see the file in this directory What i miss ?? Thanks for your help best regards Alexandre
... View more
