Logged in as an Administrator, but why am I unable to delete a field or perform an action?

[rafasalo]

Hello,

As you can see below, I can't do any action, and when I click on PERMISSIONS, I get this error:

Splunk could not retrieve permissions for resource data/props/extractions [HTTP 404] https://127.0.0.1:8089/servicesNS/desenvolvimento/search/data/props/extractions/dbx2%20%3A%20EXTRACT...; [{'code': None, 'type': 'ERROR', 'text': "\n In handler 'props-extract': Could not find object id=dbx2 : EXTRACT-GPVersion"}]

Even, as Administrator.

Cheers,

[lguinn2]

Maybe you have a knowledge object that has no entry in the corresponding meta file. Look in the user's directory at

$SPLUNK_HOME/etc/users/USERNAME/search/meta/local.meta
and
$SPLUNK_HOME/etc/users/USERNAME/search/local/props.conf (or maybe transforms.conf)

for the field extraction and its corresponding permissions entry. You could manually delete them both...

But when manually editing, be sure to keep the .conf file in sync with the corresponding meta file. Otherwise, weird stuff can happen, especially when you try to edit the knowledge object in the Splunk UI.