Hi Team,
We have a distributed environment with Search Head and Indexers clustered running on 6.5.2.
We are facing issues while running dashboards throwing errors "Could not create search" on few dashboard panels. This is being regularly (but not for all users). We do have some dependent panels and tags being used for time ranges. Will these tags cause some issues while running dashboards?
Could you please help in resolving this issue? Thanks in advance.
@siva_cg, following are some of your options:
Hey siva_cg ,
This problem can be based on role access, If the role for the user has less concurrent_searches capability then this error might occur.
Refer the link below:
http://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities
Hope this helps!!
The problem is that a full browser refresh is required to get rid of the "Could not create search" message, i.e. the built in panel refresh and dashboard level refresh do not clear the message.
Have you fixed this issue? I got the same issue.
FYI, adding the search and rtsearch capabilities to my role fixed this issue for me.