New to Splunk.... Was in the role section and deleted the User role and now I am getting the error "Authorization Failed: [HTTP 403] Client is not authorized to perform requested action". Any clue how to correct? Thanks
You may also want to check if the user role has the capability "rest_properties_get" as this error can occur if the default Splunk authentication is in use and this capability is missing.
You may also want to check if the user role has the capability "rest_properties_get" as this error can occur if the default Splunk authentication is in use and this capability is missing.
Do you mean you can no longer log in to Splunk at all, even as the admin user?
If you can log in as admin, what happens when you try to re-create the User role?
Oooh. I'm not sure how to advise you in that case. I was going to suggest simply re-creating the User role via the manager. I believe there's a way to do it from the file system without logging in. Perhaps someone on here will know the answer to that.
