| rest /services/authentication/current-context splunk_server=local | rename username AS username roles AS role | mvexpand role | fields realname username role email | join type=outer role [ rest /services/authorization/roles splunk_server=local | rename title AS role | eval role_indexes=mvjoin(srchIndexesAllowed,";") | eval imported_indexes=mvjoin(imported_srchIndexesAllowed,";") | eval allowed_indexes=mvappend(imported_indexes, role_indexes) | fields role allowed_indexes role_indexes imported_indexes | rex mode=sed field=allowed_indexes "s/;/\n/g" ] | join type=outer role [ rest /services/admin/LDAP-groups splunk_server=local | mvexpand roles | fields roles, strategy,title | rename roles as role | rename title as ADGroup] | table realname username email role allowed_indexes,ADGroup,strategy ... View more

Permissions issue can be resolved using your login non-root  user . Sequence like below: my non-root user which use wget is  sccStudent:sccStudent     REMOTE_SCRIPT_DEPLOY=" cd /opt sudo /opt/splunkforwarder/bin/splunk stop sudo rm -rf /opt/splunkforwarder sudo $WGET_CMD #sudo chmod 755 splunkforwarder-8.2.3-cd0848707637-Linux-x86_64.tgz sudo tar xvzf $INSTALL_FILE sudo rm $INSTALL_FILE sudo mkdir -p /opt/splunkforwarder/etc/apps/$DEPLOY_APP_FOLDER_NAME/local sudo chown -R sccStudent:sccStudent /opt/splunkforwarder sudo echo \"[user_info] USERNAME = admin PASSWORD = $PASSWORD\" > /opt/splunkforwarder/etc/system/local/user-seed.conf sudo echo \"[target-broker:deploymentServer] targetUri = $DEPLOY_SERVER\" > /opt/splunkforwarder/etc/apps/$DEPLOY_APP_FOLDER_NAME/local/deploymentclient.conf sudo useradd $SPLUNK_RUN_USER sudo chown -R $SPLUNK_RUN_USER:$SPLUNK_RUN_USER /opt/splunkforwarder sudo -u $SPLUNK_RUN_USER /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt sudo /opt/splunkforwarder/bin/splunk enable boot-start -user $SPLUNK_RUN_USER exit "       ... View more

We faced same and got fixed with ES 6.6.1 +hot fix splunk provided ... View more

Its fixed with the latest version of TA TA-cisco_ios/lookups/cisco_ios_acl_excluded_ips.csv src_ip,"description" 127.0.0.1,"localhost" ... View more