Splunk Search

custom search command throw "You have insufficient privileges to perform this operation."

dellytaniasetia
Explorer

I copy gauge.py under C:\Program Files\Splunk\etc\apps\search\bin into C:\Program Files\Splunk\etc\apps\search\bin\test.py

I have followed the tutorial to create the command.conf and authorize.conf under C:\Program Files\Splunk\etc\apps\search\local. Restart the splunk but still throw the same error. However, i am able to run gauge command fine.

I am using admin user.

--Content of authorize.conf--
[capability::run_script_test]
[role_admin]
run_script_test= enabled

--Content of command.conf--
[test]
filename = test.py

Any advise will be appreciated.

Tags (1)
0 Karma

PowerPacked
Builder

Hello@ agu_srishti

adding as a new answer, as i cant post an image in comments.

custom command test can work, but am not sure it yields the results expected ----- as according to the python code.

alt text

Thanks

0 Karma

agu_srishti
Engager

Hi @PowerPacked

test seems to be an internal reserved command for Splunk so you cant name your script as test.

means open your splunk SH now and execute "| test" you will get the same error "You have insufficient privileges to perform this operation." even though you haven't created anything called test.

0 Karma

PowerPacked
Builder

Hi @dellytaniasetiawan

look if test.py file has executable permissions on the server.

and also try to run the search with | test as starting.

Thanks

0 Karma

agu_srishti
Engager

For some reason name "test" seems reserved. Try any other name and it works

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Did you create the local.meta entries for your custom search command?

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi dellytaniasetiawan,

I think your role does not have sufficient capabilities to run the custom command. Please make sure the admin_all_objects capability has been granted to your admin role:

  1. In Splunk Web, select Settings > Access Controls.
  2. Click Roles.
  3. Click admin.
  4. Under Capabilities, select and move the admin_all_objects capability from the right column to the right.
  5. Click Save.

Please try this and see if this will grant you the appropriate rights to run the script.
Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...