https://community.splunk.com/t5/Security/Create-saved-search-via-javascript-for-user-that-does-not-have/m-p/573481#M15694 <P>Splunk JDK is taking credentials of currently logged in user so, since your regular "user" do not have sufficient permissions, they will not be able to create saved searches and can't create a saved search as some other user (admin in your case).&nbsp;</P><P>Splunk has created different roles so that people with right knowledge get right access. For users who should create an alert, why not give them "power" user access with which they should be able to create alerts. See more details on Splunk user roles here:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Aboutusersandroles" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Aboutusersandroles</A></P> Wed, 03 Nov 2021 13:48:21 GMT somesoni2 2021-11-03T13:48:21Z https://community.splunk.com/t5/Security/Create-saved-search-via-javascript-for-user-that-does-not-have/m-p/573462#M15693 <P>&nbsp;</P><P>&nbsp;</P><P>Our app has a functionality where users can create alerts for specific events. Unfortunately the users do not have the rights to create saved searches (we are on a multi-tenant platform, so we cannot change user rights).&nbsp;</P><P>The code for this is:</P><P>&nbsp;</P><LI-CODE lang="markup">var service = mvc.createService(); var mySavedSearches = service.savedSearches(); mySavedSearches.init(admin_service, {app:"APP", sharing:"app"}); // Create a saved search/report as an alert. // service.savedSearches().create(alertOptions, function (err, alert) { mySavedSearches.create(alertOptions, function (err, alert) { console.log("ALERT"); // Error checking. if (err &amp;&amp; err.status === 409) { console.error("ERROR: A saved alert with the name '" + alertOptions.name + "' already exists"); error(alertOptions.name); return; } else if (err) { console.error("There was an error creating the alert:", err); return; } // Confirmation message. console.log("Created alert: " + alert.name); });</LI-CODE><P>&nbsp;</P><P>When logged in as an admin user, the saved searches are created. However, when logged in as a normal user, the following error appears:</P><P>&nbsp;</P><LI-CODE lang="markup">User 'user' with roles { db_connect_user, user } cannot write: /nobody/APP/savedsearches/test_saved_search { read : [ admin, user ], write : [ admin ] }, export: app, removable: no, modtime: 1559130962.504602000</LI-CODE><P>&nbsp;</P><P>Would it be possible to create these saved searches as admin, by for instance creating a service with the admin user? How could I do this? I have tried:</P><P>&nbsp;</P><LI-CODE lang="markup">var service = mvc.createService({ owner: "admin" })</LI-CODE><P>&nbsp;</P><P>but this did not work.</P> Wed, 03 Nov 2021 10:29:02 GMT https://community.splunk.com/t5/Security/Create-saved-search-via-javascript-for-user-that-does-not-have/m-p/573462#M15693 BernardEAI 2021-11-03T10:29:02Z https://community.splunk.com/t5/Security/Create-saved-search-via-javascript-for-user-that-does-not-have/m-p/573481#M15694 <P>Splunk JDK is taking credentials of currently logged in user so, since your regular "user" do not have sufficient permissions, they will not be able to create saved searches and can't create a saved search as some other user (admin in your case).&nbsp;</P><P>Splunk has created different roles so that people with right knowledge get right access. For users who should create an alert, why not give them "power" user access with which they should be able to create alerts. See more details on Splunk user roles here:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Aboutusersandroles" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Aboutusersandroles</A></P> Wed, 03 Nov 2021 13:48:21 GMT https://community.splunk.com/t5/Security/Create-saved-search-via-javascript-for-user-that-does-not-have/m-p/573481#M15694 somesoni2 2021-11-03T13:48:21Z