Why does using Sideview Utils SearchControls module to export data into a CSV not work for any roles other than admin?

[spyme72]

i am using Sideview SearchControls module to export data from table into csv.
It works fine when i am the admin but it doesnt work for any other roles.
The file gets exported for other users but they get the following error message in the csv.
Can anybody help me to find the appropriate role for this capability?

ERROR:

<msg type="FATAL">User 'guest' could not act as: rkbask_na_p</msg>

[spyme72]

this is the view i am using. it uses a saved search along with postprocess

View

Adhoc

<param name="filter">*</param>
<param name="maxSize">2</param>
<param name="clearOnJobDispatch">False</param>



<param name="html"><![CDATA[
    <h1>Adhoc Search</h1>
    ]]></param>




<module name="SavedSearch">
  <param name="name">WaasMonitoring-30d</param>

  <module name="HTML">
    <param name="html">

<b>

  </module>

  <module name="TextField">
    <param name="float">left</param>
    <param name="name">EventCode</param>
    <param name="label">EventCode</param>
    <param name="template">EventCode="$value$"</param>

    <module name="TextField">
      <param name="name">NetworkCode</param>
      <param name="label">NetworkCode</param>
      <param name="template">NetworkCode="$value$*"</param>

      <module name="TextField">
        <param name="float">left</param>
        <param name="name">Site</param>
        <param name="label">Site</param>
        <param name="template">Site="$value$"</param>

        <module name="TextField">
          <param name="name">location_id</param>
          <param name="name">location_id</param>
          <param name="label">Location Id</param>
          <param name="template">location_id="$value$"</param>

          <module name="TextField">
            <param name="float">left</param>
            <param name="name">SiteTier</param>
            <param name="label">SiteTier</param>
            <param name="template">SiteTier="$value$"</param>

            <module name="TextField">
              <param name="float">left</param>
              <param name="name">SiteCategory</param>
              <param name="label">SiteCategory</param>
              <param name="template">SiteCategory="$value$"</param>

              <module name="TextField">
                <param name="name">Site_SubCategory</param>
                <param name="label">Site SubCategory</param>
                <param name="template">Site_SubCategory="$value$"</param>

                <module name="HTML">
                  <param name="html"><![CDATA[

Note : Search is run for the past 30 days.

Wildcards can be used

]]>

                <module name="Button">
                  <param name="allowAutoSubmit">False</param>

                  <module name="PostProcess">
                    <param name="search"><![CDATA[

search $EventCode$ $NetworkCode$ $Site$ $location_id$ $SiteTier$ $SiteCategory$ $Site_SubCategory$ | table _time EventCode priority NetWorkCode location_id Region Site SiteStatus SiteTier SiteCategory Site_SubCategory]]>

                    <module name="Pager">
                      <param name="maxPages">50</param>
                      <param name="count">20</param>

                      <module name="Table">




                      <module name="SearchControls">
                        <param name="sections">export </param>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

[sideview]

That's very strange. The feature is certainly tested to work with power- and user-level users, and our testcases still pass at least with Sideview Utils 3.3.2 on Splunk 6.2.1

I'm exporting results as a user-level user now and I can't see any problem.

It sounds like "rkbask_na_p" is another user account, and you are using distributed search, such that the guest account is somehow mapped to "become" the user rkbask_na_p" on one of your configured search peers, yet that runs into trouble at runtime.

Of course how that could manifest only when results are exported... i have no idea! Maybe we have a bug where "warn" messaging supercedes the actual results when we're writing out the response.

I do see similar error messages showing up in other cases - is "user XXX could not act as Y"
http://answers.splunk.com/answers/114224/streamed-search-execute-failed-because-user-could-not-act-a...

[spyme72]

thanks a lot for the response.
i am using splunk 6.2 and sideview utils 3.3..
any help on how to fix it?