Excel Export is not working for user role

[ktc78]

Hello,
I'm using splunk version 6.6.3 (build e21ee54bc796) on my Ubuntu 14.04.5 server
After installing Excel export tool (ver 2.0.4) I found something weird

With admin permission, all things working perfect
but with user role, it gives below message after clicking 'Excel Export' button

IE : "View more information about your request (request ID = 5a016640a87f8d68407590) in Search" -> No info found with given link
FireFox : "Firefox cannot find file Firefox는 http://168.219.245.248:8000/ko-KR/custom/excel_export/excel/1510041258.937?filename=dgfdfgd&count=10..."

• I also give full APP R/W permission to everyone already

Did I miss something wrong?
I really donno what makes the difference between admin & user role

Thanks!

[lsw6875]

I found this role capabilities.

list_settings

you must add this role capabilities.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities

[ehudb]

Adding list_settings to the role is the correct solution for Excel export tool.
Works for me as well
Thanks!

[ktc78]

Dear spl109,
Thank you so much for your solution and It seems to be working fine!

Anyway I modified UTF8 type export function script & using well without Excel export tool now
(without broken character)

I modified below file
.../lib/python2.7/site-packages/splunk/rest/init.py

Commented below
response = self.response
while 1:
data = response.read(blocksize)
if not data:
break
yield data

And added below
response = self.response
import codecs
counter = 0;
while 1:
data = response.read(blocksize)
if not data:
break
if counter == 0:
data = "".join((codecs.BOM_UTF8, data))
counter += 1
yield data

Then csv export goes well without broken charater

I really appreciate your kind advice!

[koshyk]

i'm not familiar with the Excel Export app. But just try creating a new role (say myuser)
- inherit all capabilities from admin into this myuser
- try removing capabilities which you think are not useful and restart splunk.
- Try this approach until you find the correct capability which is used for this app.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities

output_file and export_results_is_visible capabilities are something which comes to my mind.

[spl109]

hi
I solved it.

add the following: local.meta

A. vi $SPLUNK_HOME/etc/apps/excel_export/metadata/local.meta
===============================================
[views/flashtimeline_excel]
access = read : [ admin, power,user ], write : [ admin ]
==============================================

B. web : http://168.219.245.248:8000/ko-KR/debug/refresh

[ktc78]

thanks you so much for your valuable advice
I'll try your way first
Anyway it would be nice if I have another solution without changing role permission 🙂