topic Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2. in All Apps and Add-ons

Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1.

apietersen — Fri, 16 Nov 2018 15:39:11 GMT

Hi,

Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1
With user account admin no problems. Any other user throws a error message. When giving that user only "edit-all-objects" capability it works again, but this feels to much for a regular user. No information found what the essential capabilities re for this app.

We need to use some email-forms and the ssearch start with: | makeresults | eval .....| sendresults

somebody a clue?

regards Ashley Pietersen

Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1.

mockd — Fri, 16 Nov 2018 16:24:53 GMT

Hi,

Thanks for posting about this issue. It's going to need a bit more investigation but I was able to reproduce the same issue.

It looks like the sendemail command also has some issues with lesser capabilities as well.

I'll do some testing and see if there is something we need to change in sendresults and/or what permissions need to be applied.

Derek.

Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1.

apietersen — Sat, 17 Nov 2018 08:31:45 GMT

Thanks Derek,
If I find some more details I will post it here..

Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1.

apietersen — Tue, 29 Sep 2020 22:00:39 GMT

Btw this is the error-message when using a regular user-account using the search code:

| makeresults
| eval email_to="(valid-email-address)", email_subj="testing" , email_body="testing"
| sendresults

Error-message:

command="sendresults", Error : Traceback: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\sendresults\bin\sendresults.py", line 261, in sendemail(recipient, recipient_list[recipient].get('email_subj') , outbound, argvals) File "C:\Program Files\Splunk\etc\apps\sendresults\bin\sendresults.py", line 116, in sendemail smtp.sendmail(sender, string.split(recipient, ","), message) File "C:\Program Files\Splunk\Python-2.7\Lib\smtplib.py", line 736, in sendmail self.rset() File "C:\Program Files\Splunk\Python-2.7\Lib\smtplib.py", line 470, in rset return self.docmd("rset") File "C:\Program Files\Splunk\Python-2.7\Lib\smtplib.py", line 395, in docmd return self.getreply() File "C:\Program Files\Splunk\Python-2.7\Lib\smtplib.py", line 369, in getreply raise SMTPServerDisconnected("Connection unexpectedly closed") SMTPServerDisconnected: Connection unexpectedly closed

Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.1.

apietersen — Sat, 17 Nov 2018 09:21:14 GMT

Please note: we send via an Office365 email-account

Re: Sendresults App: what is the minimal user capability needed to use your sendresults app in Splunk Ent. version 7.2.

brimarwells — Thu, 12 Nov 2020 09:38:57 GMT

This exception is raised when the server unexpectedly disconnects, or when an attempt is made to use the python mail SMTP instance before connecting it to a server. Clients sending outgoing mail should connect on port 587 and use starttls. To use port 465, you need to call smtplib.SMTP_SSL(). Currently, it calls smtplib.SMTP() .. so,change your PORT from 465 into 587 it. Also, you'll need to send the ehlo command before the starttls command, then again after the starttls command.