Splunk Search

Do users need some capability to use search commands based on Python scripts like xmlkv?

ivarny
Path Finder

We have users with somewhat limited capabilities using custom search home apps.
They are able to search the data they should, but gets an error when trying to use python based search commands, specifically
xmlkv.

The search looks like:

index=win* host=vm-ktapp-2 LogName=Application | xmlkv

As admin I am able to run the search, but the users get the error:

Unknown search command 'xmlkv'.

We are on 6.3.3 currently.

I am suspecting some capability is needed to allow using the Python base search commands, but I have trouble guessing which.
Anyone have an idea?

The users have these capabilites now:

accelerate_search
change_own_password
get_metadata
get_typeahead
input_file
list_inputs
output_file
pattern_detect
request_remote_tok
rest_apps_view
rest_properties_get
rest_properties_set
schedule_rtsearch
search
0 Karma
1 Solution

ivarny
Path Finder

The solution to this was to find in the local.meta permissions setup.

We wanted a general locked down approach and open up on the specific level.
This does not seem to be supported as the general settings overrides the more specific settings.

We had in ./apps/search/metadata/local.meta

[] 
access= read [ admin ], write [ admin ]

then for commands we wanted to grant access

[commands]
access = read : [ * ], write : [ admin ]
export = system

But this did not work since the [] stanza overrules the [commands] stanza.

Therefore we had to put

[]
access = read : [ * ], write : [ admin ]

And then tighten in on each more specific stanza...

View solution in original post

0 Karma

ivarny
Path Finder

The solution to this was to find in the local.meta permissions setup.

We wanted a general locked down approach and open up on the specific level.
This does not seem to be supported as the general settings overrides the more specific settings.

We had in ./apps/search/metadata/local.meta

[] 
access= read [ admin ], write [ admin ]

then for commands we wanted to grant access

[commands]
access = read : [ * ], write : [ admin ]
export = system

But this did not work since the [] stanza overrules the [commands] stanza.

Therefore we had to put

[]
access = read : [ * ], write : [ admin ]

And then tighten in on each more specific stanza...

0 Karma

sgundeti
Path Finder

most scripted commands are available under SPLUNK_HOME/etc/apps/search/bin including xmlkv.py. So ensure your user role is readable on default search&reporting app. If you do not want user to use default search app then copy xmlkv.py to your custom search home app bin directory.

0 Karma

ivarny
Path Finder

I had tested copying xmlkv.py to the home app of the user(s) but that did not solve it.

0 Karma

sundareshr
Legend

Have you checked the file permission on the .py?

0 Karma

ivarny
Path Finder

Yes, owned by splunk and r-x for all so that's not it. One interesting thing is that it exists only in ~/etc/apps/search/bin. So I tried copying it into the /bin folder of our custom app, but nothing changed, so I think that is also barking up the wrong tree. Therefore I think it must be some missing capability for these users.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...