I have a power user who wants to save the results to a summary index, using sistats. The index exists on each indexer and on the search-head, but when he tries to save it, an error message appears:
"Encountered the following error while trying to save: In handler 'savedsearch': Index name=eupaternitysummary does not exist. The summary index must exist in order for a scheduled search to populate it."
When I edit the search and save it to use this summary index, it works. Is there a permissions issue for indexes?
Check if the role assigned to the user have access to that index. Go to Settings-> User Access-> Roles -> That Particular Role -> Indexes (last section) and see if the index eupaternitysummary is listed there.
Yes, A user or all user in that role will only have access to Indexers defined by Settings-> User Access-> Roles -> That Particular Role -> Indexes.
If you want a universal access, you can select options "All non-internal indexes" to access to all indexes (non splunk's internal)
I'm curious on this one. I've never been able to index anything into splunk aside from via the admin user. I've even created a role (back in 4.2.2) and granted it every permission available and still not been able to upload anything that way. I'd think summarizing into an index would follow suit as it's uploading data to the index.