We have users with somewhat limited capabilities using custom search home apps.
They are able to search the data they should, but gets an error when trying to use python based search commands, specifically
The search looks like:
index=win* host=vm-ktapp-2 LogName=Application | xmlkv
As admin I am able to run the search, but the users get the error:
Unknown search command 'xmlkv'.
We are on 6.3.3 currently.
I am suspecting some capability is needed to allow using the Python base search commands, but I have trouble guessing which.
Anyone have an idea?
The users have these capabilites now:
accelerate_search change_own_password get_metadata get_typeahead input_file list_inputs output_file pattern_detect request_remote_tok rest_apps_view rest_properties_get rest_properties_set schedule_rtsearch search
Yes, owned by splunk and r-x for all so that's not it. One interesting thing is that it exists only in ~/etc/apps/search/bin. So I tried copying it into the /bin folder of our custom app, but nothing changed, so I think that is also barking up the wrong tree. Therefore I think it must be some missing capability for these users.
most scripted commands are available under SPLUNK_HOME/etc/apps/search/bin including xmlkv.py. So ensure your user role is readable on default search&reporting app. If you do not want user to use default search app then copy xmlkv.py to your custom search home app bin directory.
I had tested copying xmlkv.py to the home app of the user(s) but that did not solve it.
The solution to this was to find in the local.meta permissions setup.
We wanted a general locked down approach and open up on the specific level.
This does not seem to be supported as the general settings overrides the more specific settings.
We had in
 access= read [ admin ], write [ admin ]
then for commands we wanted to grant access
[commands] access = read : [ * ], write : [ admin ] export = system
But this did not work since the
 stanza overrules the
Therefore we had to put
 access = read : [ * ], write : [ admin ]
And then tighten in on each more specific stanza...