custom search command throw "You have insufficient privileges to perform this operation."

[dellytaniasetia]

I copy gauge.py under C:\Program Files\Splunk\etc\apps\search\bin into C:\Program Files\Splunk\etc\apps\search\bin\test.py

I have followed the tutorial to create the command.conf and authorize.conf under C:\Program Files\Splunk\etc\apps\search\local. Restart the splunk but still throw the same error. However, i am able to run gauge command fine.

I am using admin user.

--Content of authorize.conf--
[capability::run_script_test]
[role_admin]
run_script_test= enabled

--Content of command.conf--
[test]
filename = test.py

Any advise will be appreciated.

[PowerPacked]

Hello@ agu_srishti

adding as a new answer, as i cant post an image in comments.

custom command test can work, but am not sure it yields the results expected ----- as according to the python code.

Thanks

[agu_srishti]

Hi @PowerPacked

test seems to be an internal reserved command for Splunk so you cant name your script as test.

means open your splunk SH now and execute "| test" you will get the same error "You have insufficient privileges to perform this operation." even though you haven't created anything called test.

[PowerPacked]

Hi @dellytaniasetiawan

look if test.py file has executable permissions on the server.

and also try to run the search with | test as starting.

Thanks

[agu_srishti]

For some reason name "test" seems reserved. Try any other name and it works

[somesoni2]

Did you create the local.meta entries for your custom search command?

[hunters_splunk]

Hi dellytaniasetiawan,

I think your role does not have sufficient capabilities to run the custom command. Please make sure the admin_all_objects capability has been granted to your admin role:

1. In Splunk Web, select Settings > Access Controls.
2. Click Roles.
3. Click admin.
4. Under Capabilities, select and move the admin_all_objects capability from the right column to the right.
5. Click Save.

Please try this and see if this will grant you the appropriate rights to run the script.
Hope it helps. Thanks!
Hunter