I tried using the Website Input app on server with a Free license. The following error occurs:
You do not have the capabilities necessary to edit or create this type of input. You need to have both the "editmodinputwebinput" and "listinputs" capabilities.**
Is there a way to work around this issue?
After 60 days I changed to license group "Free License". Before that the only user I had was admin...
I did not change anything with regards to Users/Roles.
By the way, this issue occurs on both my Windows and Linux test server.
Just a point of interest regarding licensing, that I figured I'd share as I poked through this....If you go to Settings > Licensing > All License details, you can see the capabilities included in the license.
For example FREE license shows:
Splunk Free creation_time 2010-06-20 07:00:00+00:00 expiration_time 2038-01-19 03:14:07+00:00 features FwdData KVStore LocalSearch RcvData ScheduledSearch SigningProcessor SplunkWeb hash FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF is_unlimited False label Splunk Free max_violations 3 payload None quota_bytes 524288000.0 sourcetypes stack_name free status VALID type free window_period 30
Where as the Enterprise, or Dev license will show:
Splunk Developer Personal License NOT FOR RESALE creation_time 2017-01-13 22:02:05+00:00 expiration_time 2017-07-13 21:02:05+00:00 features Acceleration AdvancedSearchCommands AdvancedXML Alerting AllowDuplicateKeys ArchiveToHdfs Auth CanBeRemoteMaster CustomRoles DeployClient DeployServer DistSearch FwdData GuestPass KVStore LDAPAuth LocalSearch MultifactorAuth MultisiteClustering NontableLookups RcvData RcvSearch RollingWindowAlerts SAMLAuth ScheduledAlerts ScheduledReports ScheduledSearch ScriptedAuth SearchheadPooling SigningProcessor SplunkWeb SyslogOutputProcessor UnisiteClustering hash <REDACTED> is_unlimited False label Splunk Developer Personal License NOT FOR RESALE max_violations 5 payload None quota_bytes 10737418240.0 sourcetypes stack_name enterprise status VALID type enterprise window_period 30
While it isn't super obvious which of these capabilities are the culprit, (my guess is the advancedXml used in app setup or something) based on what you have advised, I'd say something in the modular inputs framework is not supported in the free version. I will dig a little deeper to confirm, but to your question about getting around it, I would suggest you request a free 10GB dev license, (http://dev.splunk.com/page/developer_license_sign_up/) or if you work for a Splunk customer, request one of our personal 50GB licenses (https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html)
I will mimic in my lab to see what else is possible and update this post.
While I stick to my recommendation of getting hooked up with a dev or personal dev license for best experience...I confirmed that the issue appears to be in the elements the app uses in the GUI, not the inputs themselves. The configuration of the inputs in the gui uses a real nice set up wizard, and I believe that is the item that is affected by the free license.
That being said, I was totally able to create a working inputs.conf using the CLI. I simply poked through $SPLUNKHOME/etc/apps/websiteinput/README/inputs.conf.spec to build the necessary inputs file. Here is my example:
[web_input://test_website_input] browser = integrated_client depth_limit = 25 index = main interval = 1m output_as_mv = 1 page_limit = 1 raw_content = 0 timeout = 5 title = Test Website Input url = http://canihazip.com/s use_element_name = 0 user_agent = Splunk Website Input (+https://splunkbase.splunk.com/app/1818/)
This is actually real good way to learn about spec files and splunk config files which are contained in splunk apps, that advise what settings are available, and if documented correctly, what they do...although you lose a bit of the preview functionality and ease of use the gui wizard provides...
Hope that helps!
The following two files were updated:
The change is listed here: https://github.com/LukeMurphey/splunk-web-input/commit/b65eee6657c60422f7906d2feb0e6d665539bb7a