Quick Tip: Internal Server Error (500) on Splunk debug/refresh

After upgrading Splunk from 6.5.0 to 7.0.4, I tried to use the /debug/refresh REST endpoint, and received an error. The error appeared after clicking the refresh button:

I clicked on the link for more information which showed me the error was due to missing permissions:

The solution was to add the refresh_application_licenses capability to my admin role. The other required capability is web_debug, which I already had selected.

After adding the required permissions, /debug/refresh was working again! The required permissions must have changed at some point between 6.5.0 and 7.0.2, as debug/refresh had always worked for me prior to the upgrade.

Rate this post:
Share this post:

Leave a Reply