topic Re: Power User cannot share saved searches despite having power role and having write permissions into their App in Splunk Search

Power User cannot share saved searches despite having power role and having write permissions into their App

LOP22456 — Thu, 07 Aug 2025 15:51:04 GMT

We have a search app that a group of users are working from. All of the users have power role and we have given the power role write permissions into the app. When they try to share some saved searches, they are getting this error:

User 'XXXX' with roles { XXX-power, XXX-user } cannot write: /nobody/XXX_Splunk_app/savedsearches/ Test { read : [ XXX-power, XXX-user ], write : [ XXX-admin ] }, export: app, owner: nobody, removable: no, modtime: 1754574650.678659000

From what I read online, once a user is given Write permissions into the App, they can share their KOs. Am I doing something wrong here or has this since changed?

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

livehybrid — Thu, 07 Aug 2025 15:58:37 GMT

Hi @LOP22456

It looks like the write permission on the savedsearch that they are trying to share doesnt include the xxx-power role, if the user sets the write permission to xxx-power instead of xxx-admin does it allow them to share?

Has the search been changed to be owned by a different user (e.g. nobody) prior to the user attempting to share it within the app?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

livehybrid — Thu, 07 Aug 2025 16:00:17 GMT

Hi @LOP22456

Further to my other comment, can you also confirm that there isnt another search already in the app with the same name? Can you also confirm that the xxx-power has write access to the app aswell as xxx-admin?

The issue I believe lies in the fact that only xxx-admin has write access to the search.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

PrewinThomas — Fri, 08 Aug 2025 04:03:35 GMT

@LOP22456

The error highlights that only the admin role currently has write access to the specific saved search.

Looks like saved search permission need to be set correctly. So go to your saved search->Edit Perimssion->Change Write access to include XXX-power

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

PrewinThomas — Fri, 08 Aug 2025 04:22:17 GMT

@LOP22456

The error highlights that only the admin role currently has write access to the specific saved search.

Looks like the saved search permission need to be set correctly. So go to your saved search->Edit Perimssion->Change Write access to include XXX-power

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

LOP22456 — Fri, 08 Aug 2025 10:19:48 GMT

Hi @livehybrid,

Thanks for your responses. Can confirm xxx-power has write access into the app:

The user that is attempting to share these saved searches in an xxx-power user, so how would it be that only the xxx-admin user can share the search if it was created by xxx-power?

Re: Power User cannot share saved searches despite having power role and having write permissions into their App

LOP22456 — Fri, 08 Aug 2025 10:39:03 GMT

This is the screenshot the user sent - just trying to share Read/Write with other xxx-power users and they don't have the permissions.