Installation

Search using 'inputcsv' stopped working after upgrade from 4.2.2->4.3.4.

sthomas
Explorer

Hi,

I recently upgraded to 4.3.4 and I'm getting the following error on my searches:

|inputcsv networks.csv | fields ip

Error in 'inputcsv' command: You have insufficient privileges input a file from var/run/splunk. You can input a temporary csv file (emitted by outputcsv within the same search) by passing 'dispatch=t' as an option.

Permissions on the .csv file are good and I'm running this search as admin.

Thanks you in advance!
Sven

Labels (1)
0 Karma
1 Solution

sthomas
Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

View solution in original post

sthomas
Explorer

Ok, it seems I solved it myself. Version 4.3.x seems to have new capabilities, "input_file" and "output_file". After upgrading splunk these need to be explicitly granted to the role in question.

Hope this helps somebody else too 😄

dmr195
Communicator

I think these new capabilities were added in either 4.3.3 or 4.3.4. I have a 4.3.2 system that DOESN'T have them and a 4.3.4 system that DOES. (I don't have a 4.3.3 system handy to check.)

0 Karma

NGRhodes
Explorer

FYI we have a 4.3.3 install that does NOT have these capabilities.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...