topic Re: insufficient permissions to perform this operation in Splunk Search

When a user queries he gets "insufficient permissions to perform this operation", and when I query I get 0 return events

anikeshp7 — Wed, 13 Jul 2022 12:36:46 GMT

I have created a lookup test123.csv owned by me and

A user queries and he gets the error - "User has insufficient permissions to perform this operation. list_workload_pools and select_workload_pools capabilities are required."

When I do the same query I don't get any error but it also return 0 events. I dont get that error is it because I own the file ?

index=123 AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

Would highly appreciate thoughts and suggestions on this .

Re: insufficient permissions to perform this operation

vgtk4431 — Thu, 10 Sep 2020 14:18:47 GMT

no the error you are giving is not about the lookup, but about the workoad capabilities that the other user does not have

is it trying to execute a search, or to execute a savedsearch are report you've provided ?

Re: insufficient permissions to perform this operation

anikeshp7 — Fri, 11 Sep 2020 05:11:40 GMT

@vgtk4431 Yes the user is trying to execute a Search. Any suggestions how this can be avoided .

Re: insufficient permissions to perform this operation

vgtk4431 — Fri, 11 Sep 2020 14:32:21 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.6/Workloads/Useworkloadmanagement

https://docs.splunk.com/Documentation/Splunk/8.0.6/Workloads/Configureworkloadmanagement

I believe they are trying to assign the search to a specific workload without the proper right...

Re: insufficient permissions to perform this operation

anikeshp7 — Sat, 12 Sep 2020 07:29:31 GMT

Any suggestions how the query can be improved @vgtk4431

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns.

Re: insufficient permissions to perform this operation

dinesh_bendigo — Wed, 13 Jul 2022 03:25:43 GMT

For me, the issue was because of workload_pool=standard_perf parameter in the url shared by admin user. As a normal user I dont have permissions to select the WLM pools. So removed that parameter and was able to run searches successfully.

Re: When a user queries he gets "insufficient permissions to perform this operation", and when I query I get 0

dkmcclory — Mon, 24 Jul 2023 20:13:12 GMT

This ticket has been open a long time, but just in case someone else runs into it...

Some people include workload specifications with the URL of a search they've done. When this occurs, and they share the link with others, then they can get this error if the other person does not have the right granted to them to select a workload pool. This most often happens when a Splunk admin shares a link with a non-admin. The fix is to remove any reference to a workload pool from the URL. Or, alternately, you can grant the role of the person running the search to allow them to list and select workload pools. But if you do the second one, then anyone with that role can select which workload pool they run in.