Why can't user save to summary index?

[a212830]

Hi,

I have a power user who wants to save the results to a summary index, using sistats. The index exists on each indexer and on the search-head, but when he tries to save it, an error message appears:

"Encountered the following error while trying to save: In handler 'savedsearch': Index name=eup_aternity_summary does not exist. The summary index must exist in order for a scheduled search to populate it."

When I edit the search and save it to use this summary index, it works. Is there a permissions issue for indexes?

[jeremiahc4]

I'm curious on this one. I've never been able to index anything into splunk aside from via the admin user. I've even created a role (back in 4.2.2) and granted it every permission available and still not been able to upload anything that way. I'd think summarizing into an index would follow suit as it's uploading data to the index.

[yannK]

make sure that the index definition "exists" on the search-head.

and that the user has a role with the capability to "schedule search"

[somesoni2]

Check if the role assigned to the user have access to that index. Go to Settings-> User Access-> Roles -> That Particular Role -> Indexes (last section) and see if the index eup_aternity_summary is listed there.

[a212830]

Does it need to be specifically allowed acccess?

[somesoni2]

Yes, A user or all user in that role will only have access to Indexers defined by Settings-> User Access-> Roles -> That Particular Role -> Indexes.

If you want a universal access, you can select options "All non-internal indexes" to access to all indexes (non splunk's internal)

[a212830]

Thanks. Just checked the role - it has "All non-internal indexes". Do they need some write permissions for summary indexes?

[somesoni2]

Also ensure that the role for your user have "schedule_search" capabilities.