All Apps and Add-ons

Insufficient permissions with Free license

schollaert
Explorer

Hi,

I tried using the Website Input app on server with a Free license. The following error occurs:

**Insufficient permissions
You do not have the capabilities necessary to edit or create this type of input. You need to have both the "edit_modinput_web_input" and "list_inputs" capabilities.
**

Is there a way to work around this issue?

Best regards,

Jan

Tags (1)
1 Solution

LukeMurphey
Champion

I updated the user interface so that it now supports running with a free license; just get version 4.1.2 or later.

View solution in original post

LukeMurphey
Champion

I updated the user interface so that it now supports running with a free license; just get version 4.1.2 or later.

cmodyssey
Explorer

Hi,

Could someone let me know what the steps are to either update the user interface or install Website input outside of the browser interface (maybe @LukeMurphey) please?

Thanks,

Richard.

mattymo
Splunk Employee
Splunk Employee

Hey Schollaert,

Just a point of interest regarding licensing, that I figured I'd share as I poked through this....If you go to Settings > Licensing > All License details, you can see the capabilities included in the license.

For example FREE license shows:

Splunk Free
creation_time   2010-06-20 07:00:00+00:00
expiration_time 2038-01-19 03:14:07+00:00
features    
FwdData
KVStore
LocalSearch
RcvData
ScheduledSearch
SigningProcessor
SplunkWeb
hash    FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
is_unlimited    False
label   Splunk Free
max_violations  3
payload None
quota_bytes 524288000.0
sourcetypes 
stack_name  free
status  VALID
type    free
window_period   30

Where as the Enterprise, or Dev license will show:

Splunk Developer Personal License NOT FOR RESALE
creation_time   2017-01-13 22:02:05+00:00
expiration_time 2017-07-13 21:02:05+00:00
features    
Acceleration
AdvancedSearchCommands
AdvancedXML
Alerting
AllowDuplicateKeys
ArchiveToHdfs
Auth
CanBeRemoteMaster
CustomRoles
DeployClient
DeployServer
DistSearch
FwdData
GuestPass
KVStore
LDAPAuth
LocalSearch
MultifactorAuth
MultisiteClustering
NontableLookups
RcvData
RcvSearch
RollingWindowAlerts
SAMLAuth
ScheduledAlerts
ScheduledReports
ScheduledSearch
ScriptedAuth
SearchheadPooling
SigningProcessor
SplunkWeb
SyslogOutputProcessor
UnisiteClustering
hash    <REDACTED>
is_unlimited    False
label   Splunk Developer Personal License NOT FOR RESALE
max_violations  5
payload None
quota_bytes 10737418240.0
sourcetypes 
stack_name  enterprise
status  VALID
type    enterprise
window_period   30

While it isn't super obvious which of these capabilities are the culprit, (my guess is the advancedXml used in app setup or something) based on what you have advised, I'd say something in the modular inputs framework is not supported in the free version. I will dig a little deeper to confirm, but to your question about getting around it, I would suggest you request a free 10GB dev license, (http://dev.splunk.com/page/developer_license_sign_up/) or if you work for a Splunk customer, request one of our personal 50GB licenses (https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html)

I will mimic in my lab to see what else is possible and update this post.

[UPDATE]

While I stick to my recommendation of getting hooked up with a dev or personal dev license for best experience...I confirmed that the issue appears to be in the elements the app uses in the GUI, not the inputs themselves. The configuration of the inputs in the gui uses a real nice set up wizard, and I believe that is the item that is affected by the free license.

That being said, I was totally able to create a working inputs.conf using the CLI. I simply poked through $SPLUNK_HOME/etc/apps/website_input/README/inputs.conf.spec to build the necessary inputs file. Here is my example:

[web_input://test_website_input]
browser = integrated_client
depth_limit = 25
index = main
interval = 1m
output_as_mv = 1
page_limit = 1
raw_content = 0
timeout = 5
title = Test Website Input
url = http://canihazip.com/s
use_element_name = 0
user_agent = Splunk Website Input (+https://splunkbase.splunk.com/app/1818/)

alt text

This is actually real good way to learn about spec files and splunk config files which are contained in splunk apps, that advise what settings are available, and if documented correctly, what they do...although you lose a bit of the preview functionality and ease of use the gui wizard provides...

Hope that helps!

- MattyMo

schollaert
Explorer

Thanks for your research!

0 Karma

LukeMurphey
Champion

I'm looking into modifying the app to work with the free license under this ticket: https://lukemurphey.net/issues/1792.

mattymo
Splunk Employee
Splunk Employee

what was the piece that needed to be updated?

- MattyMo
0 Karma

LukeMurphey
Champion

The following two files were updated:

  1. appserver/static/js/views/WebsiteInputCreateView.js
  2. appserver/controllers/web_input_controller.py

The change is listed here: https://github.com/LukeMurphey/splunk-web-input/commit/b65eee6657c60422f7906d2feb0e6d665539bb7a

mattymo
Splunk Employee
Splunk Employee

Hi Schollaert!

Are you past the 60 day enterprise trial?

- MattyMo
0 Karma

schollaert
Explorer

Hi Matthew,

After 60 days I changed to license group "Free License". Before that the only user I had was admin...

I did not change anything with regards to Users/Roles.

By the way, this issue occurs on both my Windows and Linux test server.

Best regards,

Jan

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...