Splunk Add-on for ServiceNow: "Inputs Page Not Loading" due to Permission Issue

Applicability

Description

The Splunk Add-on for ServiceNow was showing an error when attempting to load the inputs page. The underlying cause was a permissions issue where the user did not have the necessary capability to perform the operation.

ERRORs:
Getting error: This operation is forbidden.

Investigation

Upon reviewing the internal logs using the SPL:

SPL:

index=_internal sourcetype=splunkd host=sh* *snow* ERROR

Found the error mentioned below:

ERRORs:

02-13-2025 18:22:20.406 +0000 ERROR AdminManagerExternal [729839 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunktaucclib/rest_handler/handler.py", line 142, in wrapper\n    for name, data, acl in meth(self, *args, **kwargs):\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunktaucclib/rest_handler/handler.py", line 194, in all\n    response = self._client.get(\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 321, in wrapper\n    return request_fun(self, *args, **kwargs)\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 76, in new_f\n    val = f(*args, **kwargs)\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 730, in get\n    response = self.http.get(path, all_headers, **query)\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 1265, in get\n    return self.request(url, {'method': "GET", 'headers': headers})\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 1337, in request\n    raise HTTPError(response)\nsplunklib.binding.HTTPError: HTTP 403 Forbidden -- b'{"messages":[{"type":"ERROR","text":"You (user=int_hnejc6v8qnk) do not have permission to perform this operation (requires capability: list_inputs)."}]}'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 114, in init_persistent\n    hand.execute(info)\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 647, in execute\n    if self.requestedAction == ACTION_LIST:     self.handleList(confInfo)\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/bin/splunk_ta_snow_rh_snow.py", line 191, in handleList\n    AdminExternalHandler.handleList(self, confInfo)\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunktaucclib/rest_handler/admin_external.py", line 63, in wrapper\n    for entity in result:\n  File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunktaucclib/rest_handler/handler.py", line 147, in wrapper\n    raise RestError(exc.status, _parse_error_msg(exc))\nsplunktaucclib.rest_handler.error.RestError: REST Error [403]: Forbidden -- This operation is forbidden.\n

The error message indicated that the user lacked the list_inputs capability, which was required for the operation.

Resolution

Granting the list_inputs capability to the user resolved the issue, and the inputs page became accessible again.

Related Links

Splunk Doc for list_input capability