Do users need some capability to use search commands based on Python scripts like xmlkv?

[ivarny]

We have users with somewhat limited capabilities using custom search home apps.
They are able to search the data they should, but gets an error when trying to use python based search commands, specifically
xmlkv.

The search looks like:

index=win* host=vm-ktapp-2 LogName=Application | xmlkv

As admin I am able to run the search, but the users get the error:

Unknown search command 'xmlkv'.

We are on 6.3.3 currently.

I am suspecting some capability is needed to allow using the Python base search commands, but I have trouble guessing which.
Anyone have an idea?

The users have these capabilites now:

accelerate_search
change_own_password
get_metadata
get_typeahead
input_file
list_inputs
output_file
pattern_detect
request_remote_tok
rest_apps_view
rest_properties_get
rest_properties_set
schedule_rtsearch
search

[ivarny · Accepted solution]

The solution to this was to find in the local.meta permissions setup.

We wanted a general locked down approach and open up on the specific level.
This does not seem to be supported as the general settings overrides the more specific settings.

We had in ./apps/search/metadata/local.meta

[] 
access= read [ admin ], write [ admin ]

then for commands we wanted to grant access

[commands]
access = read : [ * ], write : [ admin ]
export = system

But this did not work since the [] stanza overrules the [commands] stanza.

Therefore we had to put

[]
access = read : [ * ], write : [ admin ]

And then tighten in on each more specific stanza...

[sgundeti]

most scripted commands are available under SPLUNK_HOME/etc/apps/search/bin including xmlkv.py. So ensure your user role is readable on default search&reporting app. If you do not want user to use default search app then copy xmlkv.py to your custom search home app bin directory.

[ivarny]

I had tested copying xmlkv.py to the home app of the user(s) but that did not solve it.

[sundareshr]

Have you checked the file permission on the .py?

[ivarny]

Yes, owned by splunk and r-x for all so that's not it. One interesting thing is that it exists only in ~/etc/apps/search/bin. So I tried copying it into the /bin folder of our custom app, but nothing changed, so I think that is also barking up the wrong tree. Therefore I think it must be some missing capability for these users.