topic Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."? in Splunk Search

Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

fmpa_isaac — Wed, 25 Nov 2015 13:53:03 GMT

Is anyone else getting this error when performing a search? If so, can anyone help with a solution. Thank you

In handler 'savedsearch': Cannot get username when all users are selected.

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

mgonter_splunk — Fri, 11 Dec 2015 13:50:16 GMT

We are seeing it also. Have you had any traction on this error? Are you using LDAP for authentication or a custom script of some sort?

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

awurster — Sun, 10 Jan 2016 23:06:04 GMT

@mgonter_splunk - any updates on this? i am using LDAP auth in a Search Head cluster.

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

fmpa_isaac — Wed, 13 Jan 2016 15:56:31 GMT

Sorry for the delay, my engineer was able to troubleshoot it and provided the following. Please take a look and compare..
Camilla Clone - Jeff

<input type="dropdown" token="card" searchWhenChanged="true">
  <label>Select a User:</label>
  <search>
    <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| stats values(CardholderName) as card | mvexpand card</query>
  </search>
  <fieldForLabel>card</fieldForLabel>
  <fieldForValue>card</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
  <valueprefix>"CardholderName=</valueprefix>
  <valuesuffix>"</valuesuffix>
</input>


<panel>
  <title>$card$</title>
  <table>
    <search>
      <query>sourcetype="Camilla - All Events" $card$ Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description</query>
      <earliest></earliest>
      <latest></latest>
    </search>
  </table>
</panel>

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

awurster — Thu, 14 Jan 2016 01:32:41 GMT

actually to clarify, i was also seeing messages as found here in this question. this answer helped me (was actually a loadbalancing issue).

https://answers.splunk.com/answers/205904/search-head-cluster-error-usermanagerpro-failed-to.html

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

jterry — Thu, 14 Apr 2016 23:44:06 GMT

this might help:
https://answers.splunk.com/answers/330420/after-upgrading-to-splunk-63-why-do-users-have-to.html

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Jeremiah — Wed, 04 May 2016 22:55:10 GMT

That thread mentions that the problem is resolved in 6.3.2, which we are running, but we're still seeing that error come up. There were other users in the thread that said the same. Is there a confirmation that it is now fixed in 6.3.3 or 6.3.4?

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

cdoebert — Thu, 13 Oct 2016 16:12:46 GMT

I'm still seeing this as of Splunk 6.5.

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

sbbadri — Tue, 29 Sep 2020 15:00:28 GMT

I have also faced this issue while back. After long struggle, figured out the issue is with F5 VIP settings.

please check "session_cookie_insert' as the default persistence profile". Once we updated this setting above mentioned issue is gone.

I hope this helps you.