Hello,
I'm using splunk version 6.6.3 (build e21ee54bc796) on my Ubuntu 14.04.5 server
After installing Excel export tool (ver 2.0.4) I found something weird
With admin permission, all things working perfect
but with user role, it gives below message after clicking 'Excel Export' button
IE : "View more information about your request (request ID = 5a016640a87f8d68407590) in Search" -> No info found with given link
FireFox : "Firefox cannot find file Firefox는 http://168.219.245.248:8000/ko-KR/custom/excel_export/excel/1510041258.937?filename=dgfdfgd&count=10..."
Did I miss something wrong?
I really donno what makes the difference between admin & user role
Thanks!
I found this role capabilities.
list_settings
you must add this role capabilities.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities
Adding list_settings to the role is the correct solution for Excel export tool.
Works for me as well
Thanks!
Dear spl109,
Thank you so much for your solution and It seems to be working fine!
Anyway I modified UTF8 type export function script & using well without Excel export tool now
(without broken character)
I modified below file
.../lib/python2.7/site-packages/splunk/rest/init.py
Commented below
response = self.response
while 1:
data = response.read(blocksize)
if not data:
break
yield data
And added below
response = self.response
import codecs
counter = 0;
while 1:
data = response.read(blocksize)
if not data:
break
if counter == 0:
data = "".join((codecs.BOM_UTF8, data))
counter += 1
yield data
Then csv export goes well without broken charater
I really appreciate your kind advice!
i'm not familiar with the Excel Export app. But just try creating a new role (say myuser
)
- inherit all capabilities
from admin into this myuser
- try removing capabilities
which you think are not useful and restart splunk.
- Try this approach until you find the correct capability which is used for this app.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Rolesandcapabilities
output_file
and export_results_is_visible
capabilities are something which comes to my mind.
hi
I solved it.
add the following: local.meta
A. vi $SPLUNK_HOME/etc/apps/excel_export/metadata/local.meta
===============================================
[views/flashtimeline_excel]
access = read : [ admin, power,user ], write : [ admin ]
==============================================
thanks you so much for your valuable advice
I'll try your way first
Anyway it would be nice if I have another solution without changing role permission 🙂