Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges.

[tuts]

 Hello to everyone

admin' does not have sufficient search privileges.

[youngsuh]

Are you ES Admin or Admin? 

[tuts]

admin

[youngsuh]

I would open a ticket with Splunk Support.  That should be working correctly unless someone did something with the permissions Or validate that you have access to the data overview that creates the dashboard.  What version of ES are you using?

[tuts]

Use version 7.0.1

[deepakc]

Verify the user admin's setting (Users/Roles), it should be part of a role, normally admin role
Verify the admin user has srchIndexesAllowed = * and srchIndexesDefault = * (These should be default and not changed for admin)

Check if anything has changed in terms of permissions/roles for user admin role?

Run this to check via the search bar - it may help with Role settings verification.

| rest services/authorization/roles
| search title=admin
| rename title AS role
| table role, capabilities, imported_srchIndexesAllowed, imported_srchIndexesDefault, imported_srchIndexesDisallowed, srchIndexesAllowed, srchIndexesDefault, srchIndexesDisallowed

Run this to check via the search bar - it may help with user settings verification.

| rest services/authentication/users
| search title=admin
| rename title AS user
| table user, capabilities, defaultApp, email, realname, roles, splunk_server

Other than that check these for ES roles
Review the users/settings
https://docs.splunk.com/Documentation/ES/7.3.1/Install/ConfigureUsersRoles

[tuts]

I used the first command and the result was    

 But the other thing did not show any result and I do not know who to change and srchIndexesDefault = *     I'll be glad to help you.