Splunk Enterprise Security: Why do I receive "command="xswhere", [Errno 13] Permission denied" error when trying to perform a correlation search?

[deepu123]

Hello,
some correlation searches don't trigger. when I copy the search and tried to run on search window, I am getting error: "command="xswhere", [Errno 13] Permission denied". is this related to an extreme search permission issue?
thanks in advance.

Regards,
Deepak

[deepu123 · Accepted solution]

It was file permission issue, I changed the permission and now it's working 🙂

[jkat54]

The solution is to give appropriate permissions on the python files in /bin in the extreme search app.

for example, you might need execute bit enabled. So you could use ‘chmod +x’.

Another example, maybe the user splunk is running as doesn’t have execute permissions on the pyton files.