Search using 'inputcsv' stopped working after upgrade from 4.2.2->4.3.4.

[sthomas]

Hi,

I recently upgraded to 4.3.4 and I'm getting the following error on my searches:

|inputcsv networks.csv | fields ip

Error in 'inputcsv' command: You have insufficient privileges input a file from var/run/splunk. You can input a temporary csv file (emitted by outputcsv within the same search) by passing 'dispatch=t' as an option.

Permissions on the .csv file are good and I'm running this search as admin.

Thanks you in advance!
Sven

[sthomas · Accepted solution]

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

[dmr195]

I think these new capabilities were added in either 4.3.3 or 4.3.4. I have a 4.3.2 system that DOESN'T have them and a 4.3.4 system that DOES. (I don't have a 4.3.3 system handy to check.)

[NGRhodes]

FYI we have a 4.3.3 install that does NOT have these capabilities.