All Apps and Add-ons

Excel Export is not working for user role

New Member

Hello,
I'm using splunk version 6.6.3 (build e21ee54bc796) on my Ubuntu 14.04.5 server
After installing Excel export tool (ver 2.0.4) I found something weird

With admin permission, all things working perfect
but with user role, it gives below message after clicking 'Excel Export' button

IE : "View more information about your request (request ID = 5a016640a87f8d68407590) in Search" -> No info found with given link
FireFox : "Firefox cannot find file Firefox는 http://168.219.245.248:8000/ko-KR/custom/excel_export/excel/1510041258.937?filename=dgfdfgd&count=10..."

  • I also give full APP R/W permission to everyone already

Did I miss something wrong?
I really donno what makes the difference between admin & user role

Thanks!

0 Karma

Engager

I found this role capabilities.

list_settings

you must add this role capabilities.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities

Contributor

Adding list_settings to the role is the correct solution for Excel export tool.
Works for me as well
Thanks!

0 Karma

New Member

Dear spl109,
Thank you so much for your solution and It seems to be working fine!

Anyway I modified UTF8 type export function script & using well without Excel export tool now
(without broken character)

I modified below file
.../lib/python2.7/site-packages/splunk/rest/init.py

Commented below
response = self.response
while 1:
data = response.read(blocksize)
if not data:
break
yield data

And added below
response = self.response
import codecs
counter = 0;
while 1:
data = response.read(blocksize)
if not data:
break
if counter == 0:
data = "".join((codecs.BOM_UTF8, data))
counter += 1
yield data

Then csv export goes well without broken charater

I really appreciate your kind advice!

0 Karma

Super Champion

i'm not familiar with the Excel Export app. But just try creating a new role (say myuser)
- inherit all capabilities from admin into this myuser
- try removing capabilities which you think are not useful and restart splunk.
- Try this approach until you find the correct capability which is used for this app.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities

output_file and export_results_is_visible capabilities are something which comes to my mind.

0 Karma

Explorer

hi
I solved it.

add the following: local.meta

A. vi $SPLUNK_HOME/etc/apps/excel_export/metadata/local.meta
===============================================
[views/flashtimeline_excel]
access = read : [ admin, power,user ], write : [ admin ]
==============================================

B. web : http://168.219.245.248:8000/ko-KR/debug/refresh

New Member

thanks you so much for your valuable advice
I'll try your way first
Anyway it would be nice if I have another solution without changing role permission 🙂

0 Karma