Splunk Enterprise Security

Splunk Enterprise Security: Why do I receive "command="xswhere", [Errno 13] Permission denied" error when trying to perform a correlation search?

Explorer

Hello,
some correlation searches don't trigger. when I copy the search and tried to run on search window, I am getting error: "command="xswhere", [Errno 13] Permission denied". is this related to an extreme search permission issue?
thanks in advance.

Regards,
Deepak

0 Karma
1 Solution

Explorer

It was file permission issue, I changed the permission and now it's working 🙂

View solution in original post

Explorer

It was file permission issue, I changed the permission and now it's working 🙂

View solution in original post

SplunkTrust
SplunkTrust

The solution is to give appropriate permissions on the python files in /bin in the extreme search app.

for example, you might need execute bit enabled. So you could use ‘chmod +x’.

Another example, maybe the user splunk is running as doesn’t have execute permissions on the pyton files.

0 Karma