Security

As a Splunk admin user, why am I unable to access the roles menu ("Access controls")?

Ant1D
Motivator

Hi,

In Splunk Web when logged in as admin, I go to Settings > Access controls, and get the following message:

Fail: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/system/data/modular-inputs?count=-1
Details: None

What does this mean and how can I fix it?
The message appears when I click many of the options under the Settings menu

0 Karma
1 Solution

Ant1D
Motivator

Figured it out...

Visited the URL (https://MyServer:8089/servicesNS/admin/system/data/modular-inputs) and got the following message:
`

In handler 'modular-inputs': You (user=admin) do not have permission to perform this operation (requires capability: list_inputs).

`

Made necessary tweak to authorize.conf in $SPLUNK_HOME/etc/system/local/authorize.conf
Then refreshed the necessary endpoint: http(s)://yourserver:8000/en-US/debug/refresh?entity=admin/auth-services

View solution in original post

Ant1D
Motivator

Figured it out...

Visited the URL (https://MyServer:8089/servicesNS/admin/system/data/modular-inputs) and got the following message:
`

In handler 'modular-inputs': You (user=admin) do not have permission to perform this operation (requires capability: list_inputs).

`

Made necessary tweak to authorize.conf in $SPLUNK_HOME/etc/system/local/authorize.conf
Then refreshed the necessary endpoint: http(s)://yourserver:8000/en-US/debug/refresh?entity=admin/auth-services

Ant1D
Motivator

Can Splunk please include something in a future version that prevents certain Splunk capabilities from being removed if the removal can result in breaking the admin account?

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...