I copy gauge.py under C:\Program Files\Splunk\etc\apps\search\bin into C:\Program Files\Splunk\etc\apps\search\bin\test.py
I have followed the tutorial to create the command.conf and authorize.conf under C:\Program Files\Splunk\etc\apps\search\local. Restart the splunk but still throw the same error. However, i am able to run gauge command fine.
I am using admin user.
--Content of authorize.conf--
[capability::run_script_test]
[role_admin]
run_script_test= enabled
--Content of command.conf--
[test]
filename = test.py
Any advise will be appreciated.
Hi @PowerPacked
test seems to be an internal reserved command for Splunk so you cant name your script as test.
means open your splunk SH now and execute "| test" you will get the same error "You have insufficient privileges to perform this operation." even though you haven't created anything called test.
Hi @dellytaniasetiawan
look if test.py file has executable permissions on the server.
and also try to run the search with | test as starting.
Thanks
For some reason name "test" seems reserved. Try any other name and it works
Did you create the local.meta entries for your custom search command?
Hi dellytaniasetiawan,
I think your role does not have sufficient capabilities to run the custom command. Please make sure the admin_all_objects capability has been granted to your admin role:
Please try this and see if this will grant you the appropriate rights to run the script.
Hope it helps. Thanks!
Hunter