Refine your search:

Hi. This pertains to Splunk 4.2.

We have some custom commands set up. We also have external scripts that we want to run against Splunk (ie, search via the command-line) that ultimately end with a custom command call.

As you might imagine, we're a bit stuck since only an Admin has rights to run a custom command, and yet you don't want to go storing the password of a privileged user in a text file/script!

Is there any way to enable a non-Admin to execute a Custom Command so that we can do all of this with a non-privileged user? I found nothing in the UI that would allow it, and so far, the only references I have seen indicate only Admins can run these.

Thanks.

asked 27 Jan, 11:44

Sqig's gravatar image

Sqig
1154
accept rate: 22%


One Answer:

You might need to configure your script as script input. More information: http://docs.splunk.com/Documentation/Splunk/latest/Developer/ScriptedInputsIntro

Cheers, Lp

link

answered 31 Jan, 05:37

lpolo's gravatar image

lpolo
23816
accept rate: 6%

My case is for Custom Commands, which is sort of the opposite of Scripted Inputs. :) These are the Python or Perl scripts that live in "searchscripts" that you can run in the Splunk GUI...

Example: index=blah fields=xyz | stats yadda | script python myscript

(31 Jan, 07:26) Sqig

If you have access to Splunk as admin you can modify the permission of the search command: Manager » Advanced search » Search commands

I hope it helps. cheers

(31 Jan, 07:48) lpolo
1

Remarks Some search commands are not in the list in the manager, and inherit from the default settings.

Here is the method to change commands permissions in the configuration file :

edit the permission file $SPLUNK_HOME/etc/apps/search/metadata/local.meta and add the lines. [commands/FUNCTION_NAME] access = read : [ admin ], write : [ admin ] Then restart to apply. As a consequence, the function will fail silently for the user that doesn't has the admin role.

(23 Apr, 22:54) yannK
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×28
×19
×11
×3

Asked: 27 Jan, 11:44

Seen: 313 times

Last updated: 23 Apr, 22:54

Copyright © 2005-2012 Splunk, Inc. All rights reserved.