topic Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges. in Feedback

Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

tuts — Thu, 02 May 2024 08:39:11 GMT

Hello to everyone

admin' does not have sufficient search privileges.

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

deepakc — Thu, 02 May 2024 12:03:13 GMT

Verify the user admin's setting (Users/Roles), it should be part of a role, normally admin role
Verify the admin user has srchIndexesAllowed = * and srchIndexesDefault = * (These should be default and not changed for admin)

Check if anything has changed in terms of permissions/roles for user admin role?

Run this to check via the search bar - it may help with Role settings verification.

| rest services/authorization/roles | search title=admin | rename title AS role | table role, capabilities, imported_srchIndexesAllowed, imported_srchIndexesDefault, imported_srchIndexesDisallowed, srchIndexesAllowed, srchIndexesDefault, srchIndexesDisallowed

Run this to check via the search bar - it may help with user settings verification.

| rest services/authentication/users | search title=admin | rename title AS user | table user, capabilities, defaultApp, email, realname, roles, splunk_server

Other than that check these for ES roles
Review the users/settings
https://docs.splunk.com/Documentation/ES/7.3.1/Install/ConfigureUsersRoles

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

youngsuh — Thu, 02 May 2024 22:24:21 GMT

Are you ES Admin or Admin?

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

tuts — Sun, 05 May 2024 07:16:06 GMT

admin

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

tuts — Sun, 05 May 2024 08:21:22 GMT

I used the first command and the result was

But the other thing did not show any result and I do not know who to change and srchIndexesDefault = * I'll be glad to help you.

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

youngsuh — Mon, 06 May 2024 18:03:47 GMT

I would open a ticket with Splunk Support. That should be working correctly unless someone did something with the permissions Or validate that you have access to the data overview that creates the dashboard. What version of ES are you using?

Re: Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

tuts — Tue, 14 May 2024 17:30:41 GMT

Use version 7.0.1