Hi,
I tried using the Website Input app on server with a Free license. The following error occurs:
**Insufficient permissions
You do not have the capabilities necessary to edit or create this type of input. You need to have both the "edit_modinput_web_input" and "list_inputs" capabilities.**
Is there a way to work around this issue?
Best regards,
Jan
I updated the user interface so that it now supports running with a free license; just get version 4.1.2 or later.
I updated the user interface so that it now supports running with a free license; just get version 4.1.2 or later.
Hi,
Could someone let me know what the steps are to either update the user interface or install Website input outside of the browser interface (maybe @LukeMurphey) please?
Thanks,
Richard.
Hey Schollaert,
Just a point of interest regarding licensing, that I figured I'd share as I poked through this....If you go to Settings > Licensing > All License details, you can see the capabilities included in the license.
For example FREE license shows:
Splunk Free
creation_time 2010-06-20 07:00:00+00:00
expiration_time 2038-01-19 03:14:07+00:00
features
FwdData
KVStore
LocalSearch
RcvData
ScheduledSearch
SigningProcessor
SplunkWeb
hash FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
is_unlimited False
label Splunk Free
max_violations 3
payload None
quota_bytes 524288000.0
sourcetypes
stack_name free
status VALID
type free
window_period 30
Where as the Enterprise, or Dev license will show:
Splunk Developer Personal License NOT FOR RESALE
creation_time 2017-01-13 22:02:05+00:00
expiration_time 2017-07-13 21:02:05+00:00
features
Acceleration
AdvancedSearchCommands
AdvancedXML
Alerting
AllowDuplicateKeys
ArchiveToHdfs
Auth
CanBeRemoteMaster
CustomRoles
DeployClient
DeployServer
DistSearch
FwdData
GuestPass
KVStore
LDAPAuth
LocalSearch
MultifactorAuth
MultisiteClustering
NontableLookups
RcvData
RcvSearch
RollingWindowAlerts
SAMLAuth
ScheduledAlerts
ScheduledReports
ScheduledSearch
ScriptedAuth
SearchheadPooling
SigningProcessor
SplunkWeb
SyslogOutputProcessor
UnisiteClustering
hash <REDACTED>
is_unlimited False
label Splunk Developer Personal License NOT FOR RESALE
max_violations 5
payload None
quota_bytes 10737418240.0
sourcetypes
stack_name enterprise
status VALID
type enterprise
window_period 30
While it isn't super obvious which of these capabilities are the culprit, (my guess is the advancedXml used in app setup or something) based on what you have advised, I'd say something in the modular inputs framework is not supported in the free version. I will dig a little deeper to confirm, but to your question about getting around it, I would suggest you request a free 10GB dev license, (http://dev.splunk.com/page/developer_license_sign_up/) or if you work for a Splunk customer, request one of our personal 50GB licenses (https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html)
I will mimic in my lab to see what else is possible and update this post.
[UPDATE]
While I stick to my recommendation of getting hooked up with a dev or personal dev license for best experience...I confirmed that the issue appears to be in the elements the app uses in the GUI, not the inputs themselves. The configuration of the inputs in the gui uses a real nice set up wizard, and I believe that is the item that is affected by the free license.
That being said, I was totally able to create a working inputs.conf using the CLI. I simply poked through $SPLUNK_HOME/etc/apps/website_input/README/inputs.conf.spec to build the necessary inputs file. Here is my example:
[web_input://test_website_input]
browser = integrated_client
depth_limit = 25
index = main
interval = 1m
output_as_mv = 1
page_limit = 1
raw_content = 0
timeout = 5
title = Test Website Input
url = http://canihazip.com/s
use_element_name = 0
user_agent = Splunk Website Input (+https://splunkbase.splunk.com/app/1818/)
This is actually real good way to learn about spec files and splunk config files which are contained in splunk apps, that advise what settings are available, and if documented correctly, what they do...although you lose a bit of the preview functionality and ease of use the gui wizard provides...
Hope that helps!
Thanks for your research!
I'm looking into modifying the app to work with the free license under this ticket: https://lukemurphey.net/issues/1792.
what was the piece that needed to be updated?
The following two files were updated:
The change is listed here: https://github.com/LukeMurphey/splunk-web-input/commit/b65eee6657c60422f7906d2feb0e6d665539bb7a
Hi Schollaert!
Are you past the 60 day enterprise trial?
Hi Matthew,
After 60 days I changed to license group "Free License". Before that the only user I had was admin...
I did not change anything with regards to Users/Roles.
By the way, this issue occurs on both my Windows and Linux test server.
Best regards,
Jan