All Apps and Add-ons

Why does using Sideview Utils SearchControls module to export data into a CSV not work for any roles other than admin?

spyme72
Path Finder

i am using Sideview SearchControls module to export data from table into csv.
It works fine when i am the admin but it doesnt work for any other roles.
The file gets exported for other users but they get the following error message in the csv.
Can anybody help me to find the appropriate role for this capability?

ERROR:

<msg type="FATAL">User 'guest' could not act as: rkbask_na_p</msg>

spyme72
Path Finder

this is the view i am using. it uses a saved search along with postprocess

View

Adhoc

<param name="filter">*</param>
<param name="maxSize">2</param>
<param name="clearOnJobDispatch">False</param>



<param name="html"><![CDATA[
    <h1>Adhoc Search</h1>
    ]]></param>




<module name="SavedSearch">
  <param name="name">WaasMonitoring-30d</param>

  <module name="HTML">
    <param name="html">

<b>

  </module>

  <module name="TextField">
    <param name="float">left</param>
    <param name="name">EventCode</param>
    <param name="label">EventCode</param>
    <param name="template">EventCode="$value$"</param>

    <module name="TextField">
      <param name="name">NetworkCode</param>
      <param name="label">NetworkCode</param>
      <param name="template">NetworkCode="$value$*"</param>

      <module name="TextField">
        <param name="float">left</param>
        <param name="name">Site</param>
        <param name="label">Site</param>
        <param name="template">Site="$value$"</param>

        <module name="TextField">
          <param name="name">location_id</param>
          <param name="name">location_id</param>
          <param name="label">Location Id</param>
          <param name="template">location_id="$value$"</param>

          <module name="TextField">
            <param name="float">left</param>
            <param name="name">SiteTier</param>
            <param name="label">SiteTier</param>
            <param name="template">SiteTier="$value$"</param>

            <module name="TextField">
              <param name="float">left</param>
              <param name="name">SiteCategory</param>
              <param name="label">SiteCategory</param>
              <param name="template">SiteCategory="$value$"</param>

              <module name="TextField">
                <param name="name">Site_SubCategory</param>
                <param name="label">Site SubCategory</param>
                <param name="template">Site_SubCategory="$value$"</param>

                <module name="HTML">
                  <param name="html"><![CDATA[

  • Note : Search is run for the past 30 days.

  • Wildcards can be used
  • ]]>

                    <module name="Button">
                      <param name="allowAutoSubmit">False</param>
    
                      <module name="PostProcess">
                        <param name="search"><![CDATA[
    

    search $EventCode$ $NetworkCode$ $Site$ $location_id$ $SiteTier$ $SiteCategory$ $Site_SubCategory$ | table _time EventCode priority NetWorkCode location_id Region Site SiteStatus SiteTier SiteCategory Site_SubCategory]]>

                        <module name="Pager">
                          <param name="maxPages">50</param>
                          <param name="count">20</param>
    
                          <module name="Table">
    
    
    
    
                          <module name="SearchControls">
                            <param name="sections">export </param>
                          </module>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
    
    0 Karma

    sideview
    SplunkTrust
    SplunkTrust

    That's very strange. The feature is certainly tested to work with power- and user-level users, and our testcases still pass at least with Sideview Utils 3.3.2 on Splunk 6.2.1

    I'm exporting results as a user-level user now and I can't see any problem.

    It sounds like "rkbask_na_p" is another user account, and you are using distributed search, such that the guest account is somehow mapped to "become" the user rkbask_na_p" on one of your configured search peers, yet that runs into trouble at runtime.

    Of course how that could manifest only when results are exported... i have no idea! Maybe we have a bug where "warn" messaging supercedes the actual results when we're writing out the response.

    I do see similar error messages showing up in other cases - is "user XXX could not act as Y"
    http://answers.splunk.com/answers/114224/streamed-search-execute-failed-because-user-could-not-act-a...

    0 Karma

    spyme72
    Path Finder

    thanks a lot for the response.
    i am using splunk 6.2 and sideview utils 3.3..
    any help on how to fix it?

    0 Karma
    Get Updates on the Splunk Community!

    Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

    March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

    What’s New in Splunk App for PCI Compliance 5.3.1?

    The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

    Extending Observability Content to Splunk Cloud

    Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...