Reporting

Why am I getting error "DispatchManager: The user 'admin" does not have sufficient search privileges" after copying custom app from Splunk 4.3 to 6.2?

hartfoml
Motivator

I copied the app from my 4.3 server to my 6.2 server and did the https://MyServer:8000/en-US/debug/refresh

The app was there and now i am getting this kind of error In handler 'savedsearch': Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges

When I run the saved search in the app of in the search app it works so I know I have access to the data but the DispatchManager is not letting the search run in the app.

0 Karma
1 Solution

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

View solution in original post

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

djamieson99
Observer

Hi, 

 

was wondering if someone could explain the owner = admin removal from default.meta in more detail today. Very new to all of this and trying to problem shoot some issue with BOTS.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...