Reporting

Why am I getting error "DispatchManager: The user 'admin" does not have sufficient search privileges" after copying custom app from Splunk 4.3 to 6.2?

hartfoml
Motivator

I copied the app from my 4.3 server to my 6.2 server and did the https://MyServer:8000/en-US/debug/refresh

The app was there and now i am getting this kind of error In handler 'savedsearch': Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges

When I run the saved search in the app of in the search app it works so I know I have access to the data but the DispatchManager is not letting the search run in the app.

0 Karma
1 Solution

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

View solution in original post

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

djamieson99
Observer

Hi, 

 

was wondering if someone could explain the owner = admin removal from default.meta in more detail today. Very new to all of this and trying to problem shoot some issue with BOTS.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...