topic Re: inputcsv stopped working after upgrade 4.2.2->4.3.4 in Installation

Search using 'inputcsv' stopped working after upgrade from 4.2.2->4.3.4.

sthomas — Tue, 23 Jun 2020 19:14:36 GMT

Hi,

I recently upgraded to 4.3.4 and I'm getting the following error on my searches:

|inputcsv networks.csv | fields ip

Error in 'inputcsv' command: You have insufficient privileges input a file from var/run/splunk. You can input a temporary csv file (emitted by outputcsv within the same search) by passing 'dispatch=t' as an option.

Permissions on the .csv file are good and I'm running this search as admin.

Thanks you in advance!
Sven

Re: inputcsv stopped working after upgrade 4.2.2->4.3.4

sthomas — Mon, 28 Sep 2020 12:26:20 GMT

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

Re: inputcsv stopped working after upgrade 4.2.2->4.3.4

dmr195 — Thu, 21 Mar 2013 09:31:38 GMT

I think these new capabilities were added in either 4.3.3 or 4.3.4. I have a 4.3.2 system that DOESN'T have them and a 4.3.4 system that DOES. (I don't have a 4.3.3 system handy to check.)

Re: inputcsv stopped working after upgrade 4.2.2->4.3.4

NGRhodes — Mon, 30 Mar 2015 15:32:34 GMT

FYI we have a 4.3.3 install that does NOT have these capabilities.