Knowledge Management
Highlighted

Why can't user save to summary index?

Champion

Hi,

I have a power user who wants to save the results to a summary index, using sistats. The index exists on each indexer and on the search-head, but when he tries to save it, an error message appears:

"Encountered the following error while trying to save: In handler 'savedsearch': Index name=eupaternitysummary does not exist. The summary index must exist in order for a scheduled search to populate it."

When I edit the search and save it to use this summary index, it works. Is there a permissions issue for indexes?

0 Karma
Highlighted

Re: Why can't user save to summary index?

SplunkTrust
SplunkTrust

Check if the role assigned to the user have access to that index. Go to Settings-> User Access-> Roles -> That Particular Role -> Indexes (last section) and see if the index eupaternitysummary is listed there.

0 Karma
Highlighted

Re: Why can't user save to summary index?

Champion

Does it need to be specifically allowed acccess?

0 Karma
Highlighted

Re: Why can't user save to summary index?

SplunkTrust
SplunkTrust

Yes, A user or all user in that role will only have access to Indexers defined by Settings-> User Access-> Roles -> That Particular Role -> Indexes.

If you want a universal access, you can select options "All non-internal indexes" to access to all indexes (non splunk's internal)

0 Karma
Highlighted

Re: Why can't user save to summary index?

Champion

Thanks. Just checked the role - it has "All non-internal indexes". Do they need some write permissions for summary indexes?

0 Karma
Highlighted

Re: Why can't user save to summary index?

SplunkTrust
SplunkTrust

Also ensure that the role for your user have "schedule_search" capabilities.

0 Karma
Highlighted

Re: Why can't user save to summary index?

Splunk Employee
Splunk Employee

make sure that the index definition "exists" on the search-head.

and that the user has a role with the capability to "schedule search"

0 Karma
Highlighted

Re: Why can't user save to summary index?

Builder

I'm curious on this one. I've never been able to index anything into splunk aside from via the admin user. I've even created a role (back in 4.2.2) and granted it every permission available and still not been able to upload anything that way. I'd think summarizing into an index would follow suit as it's uploading data to the index.

0 Karma