Archive

custom search command throw "You have insufficient privileges to perform this operation."

I copy gauge.py under C:\Program Files\Splunk\etc\apps\search\bin into C:\Program Files\Splunk\etc\apps\search\bin\test.py

I have followed the tutorial to create the command.conf and authorize.conf under C:\Program Files\Splunk\etc\apps\search\local. Restart the splunk but still throw the same error. However, i am able to run gauge command fine.

I am using admin user.

--Content of authorize.conf--
[capability::runscripttest]
[roleadmin]
run
script_test= enabled

--Content of command.conf--
[test]
filename = test.py

Any advise will be appreciated.

Tags (1)
0 Karma

Builder

Hello@ agu_srishti

adding as a new answer, as i cant post an image in comments.

custom command test can work, but am not sure it yields the results expected ----- as according to the python code.

alt text

Thanks

0 Karma

Engager

Hi @PowerPacked

test seems to be an internal reserved command for Splunk so you cant name your script as test.

means open your splunk SH now and execute "| test" you will get the same error "You have insufficient privileges to perform this operation." even though you haven't created anything called test.

0 Karma

Builder

Hi @dellytaniasetiawan

look if test.py file has executable permissions on the server.

and also try to run the search with | test as starting.

Thanks

0 Karma

Engager

For some reason name "test" seems reserved. Try any other name and it works

0 Karma

SplunkTrust
SplunkTrust

Did you create the local.meta entries for your custom search command?

0 Karma

Splunk Employee
Splunk Employee

Hi dellytaniasetiawan,

I think your role does not have sufficient capabilities to run the custom command. Please make sure the adminallobjects capability has been granted to your admin role:

  1. In Splunk Web, select Settings > Access Controls.
  2. Click Roles.
  3. Click admin.
  4. Under Capabilities, select and move the adminallobjects capability from the right column to the right.
  5. Click Save.

Please try this and see if this will grant you the appropriate rights to run the script.
Hope it helps. Thanks!
Hunter

0 Karma