Installation

Search using 'inputcsv' stopped working after upgrade from 4.2.2->4.3.4.

sthomas
Explorer

Hi,

I recently upgraded to 4.3.4 and I'm getting the following error on my searches:

|inputcsv networks.csv | fields ip

Error in 'inputcsv' command: You have insufficient privileges input a file from var/run/splunk. You can input a temporary csv file (emitted by outputcsv within the same search) by passing 'dispatch=t' as an option.

Permissions on the .csv file are good and I'm running this search as admin.

Thanks you in advance!
Sven

Labels (1)
0 Karma
1 Solution

sthomas
Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

View solution in original post

sthomas
Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

dmr195
Communicator

I think these new capabilities were added in either 4.3.3 or 4.3.4. I have a 4.3.2 system that DOESN'T have them and a 4.3.4 system that DOES. (I don't have a 4.3.3 system handy to check.)

0 Karma

NGRhodes
Explorer

FYI we have a 4.3.3 install that does NOT have these capabilities.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...