Hi,
I am writing a script to push relevant data from our apps into a kvstore for use as a lookup.
When querying the api endpoint, I'm encountering an error.
The uri I'm accessing is: /services/storage/collections/config/?output_mode=json
HTTP 400:
{
"messages": [{
"type": "ERROR",
"text": "Must use user context of 'nobody' when interacting with collection configurations (used user='admin')"
}]
}
Hunting around for solutions, I found that this was a bug in earlier versions of Splunk.
From /answers/357860/create-a-custom-splunk-view-tutorial-not-working.html
The debug/refresh endpoint will reload configs that are available under /servicesNS/admin/search/admin endpoint. Under the admin endpoint, we have collection-conf endpoint which does provide _reload option, thus it would throw the following type of error.
In handler 'collections-conf': Must use user context of 'nobody' when interacting with collection configurations (used user='admin')
This collections-conf issue/error has now been addressed in the following releases:
- Splunk 6.2.8 - (bug: SPL-107404)
- Splunk 6.3.4 - (bug: SPL-111358)
- Splunk 6.4.0 - (bug: SPL-111360)
Is this also an error in 7.0.1 which is fixed in a later patch? If so I can ask our operations group to update it. If not, what am I doing wrong here?
Thank you very much.
... View more