Splunk Enterprise Security

Splunk Enterprise Security: Why do I receive "command="xswhere", [Errno 13] Permission denied" error when trying to perform a correlation search?

deepu123
Explorer

Hello,
some correlation searches don't trigger. when I copy the search and tried to run on search window, I am getting error: "command="xswhere", [Errno 13] Permission denied". is this related to an extreme search permission issue?
thanks in advance.

Regards,
Deepak

0 Karma
1 Solution

deepu123
Explorer

It was file permission issue, I changed the permission and now it's working 🙂

View solution in original post

deepu123
Explorer

It was file permission issue, I changed the permission and now it's working 🙂

jkat54
SplunkTrust
SplunkTrust

The solution is to give appropriate permissions on the python files in /bin in the extreme search app.

for example, you might need execute bit enabled. So you could use ‘chmod +x’.

Another example, maybe the user splunk is running as doesn’t have execute permissions on the pyton files.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...