I copy gauge.py under C:\Program Files\Splunk\etc\apps\search\bin into C:\Program Files\Splunk\etc\apps\search\bin\test.py
I have followed the tutorial to create the command.conf and authorize.conf under C:\Program Files\Splunk\etc\apps\search\local. Restart the splunk but still throw the same error. However, i am able to run gauge command fine.
I am using admin user.
--Content of authorize.conf--
--Content of command.conf--
filename = test.py
Any advise will be appreciated.
test seems to be an internal reserved command for Splunk so you cant name your script as test.
means open your splunk SH now and execute "| test" you will get the same error "You have insufficient privileges to perform this operation." even though you haven't created anything called test.
I think your role does not have sufficient capabilities to run the custom command. Please make sure the adminallobjects capability has been granted to your admin role:
Please try this and see if this will grant you the appropriate rights to run the script.
Hope it helps. Thanks!