topic Re: User could not act as admin in splunk in Splunk Search

User could not act as admin in splunk

msunilreddy — Fri, 05 Sep 2025 05:19:17 GMT

Hi Team,

We are seeing error like"user could not act as admin in splunk" for the Rest API call "/servicesNS/admin/search/search/jobs/rt_scheduler__admin__search__RMD55bf3dd661d6ebedc_at_1756741585_99.3/events?output_mode=json"

It looks like user is unable to execute this admin search query.

Coul you please explain what capabilities we need to give this user? Or point any documentation link for the same ?

How to get all alerts from Splunk using non admin user?

Thanks,

Sunil

Re: User could not act as admin in splunk

livehybrid — Fri, 05 Sep 2025 12:13:10 GMT

Hi @msunilreddy

How are you interacting with Splunk to get this error? Are you using the REST API in order to retrieve the alerts/events or is this from within Splunk itself?

Did the search that you are trying to get results for get run as the admin as a private search, not shared in the app?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: User could not act as admin in splunk

richgalloway — Fri, 05 Sep 2025 12:13:59 GMT

I suspect the error message stems from a non-admin user trying to run a command as an admin user (the "admin" in 'servicesNS/admin/...'). Try running the command /services/search/jobs/rt_scheduler__admin__search__RMD55bf3dd661d6ebedc_at_1756741585_99.3/events?output_mode=json or /servicesNS/-/search/search/jobs/rt_scheduler__admin__search__RMD55bf3dd661d6ebedc_at_1756741585_99.3/events?output_mode=json to get the information available to the user (which may be nothing).

If those don't give the desired results then you may need to give the user the list_search_scheduler or admin_all_objects capability.

BTW, that endpoint is deprecated. The user should switch to the v2 endpoint.

Re: User could not act as admin in splunk

msunilreddy — Fri, 05 Sep 2025 12:21:27 GMT

I am using RestAPI calls.