Installation

Search using 'inputcsv' stopped working after upgrade from 4.2.2->4.3.4.

Explorer

Hi,

I recently upgraded to 4.3.4 and I'm getting the following error on my searches:

|inputcsv networks.csv | fields ip

Error in 'inputcsv' command: You have insufficient privileges input a file from var/run/splunk. You can input a temporary csv file (emitted by outputcsv within the same search) by passing 'dispatch=t' as an option.

Permissions on the .csv file are good and I'm running this search as admin.

Thanks you in advance!
Sven

Labels (1)
0 Karma
1 Solution

Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "inputfile" and "outputfile". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

View solution in original post

Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "inputfile" and "outputfile". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

View solution in original post

Communicator

I think these new capabilities were added in either 4.3.3 or 4.3.4. I have a 4.3.2 system that DOESN'T have them and a 4.3.4 system that DOES. (I don't have a 4.3.3 system handy to check.)

0 Karma

Explorer

FYI we have a 4.3.3 install that does NOT have these capabilities.

0 Karma