Customer reports that when trying to upload a local file to Splunk (Add Data -> From files and directories -> Upload and index a file -> Save), Splunk reports "Success! Your data is being indexed to Splunk". However, the uploaded file is not available at the selected index. At the server side, i see this log entry at the second when clicking "Save":
splunkd.log
WARN HttpListener - Socket error from 127.0.0.1 while accessing /services/receivers/stream: Broken pipe
The issue was seen for non admin users that tried to add data to Splunk. By adding the "edit_tcp" capability to the users role, the error disappeared and uploaded data gets indexed.
The issue was seen for non admin users that tried to add data to Splunk. By adding the "edit_tcp" capability to the users role, the error disappeared and uploaded data gets indexed.