Why is report acceleration not working for non-admin users in Splunk Cloud 8.2.2112.1?

[jakemcnee95]

Hi All, having an issue where report acceleration is not working for non-admin roles. Report is accelerating correctly when running under the admin user and 'Using summaries for search' is found under the job inspector.

When running the same report under other users, report will not load over certain time periods and does not show this same 'Using summaries for search' confirmation in the job inspector.

Things I have tried for other role in question:

- Confirmed scheduled_search and accelerated_search capabilities are enabled
- Confirmed user has write access to the report
- Confirmed report is in shared app which  the user has access to
- Tried various other capabilities and inheritance from power user role

There is over 26 million events being matched, is there a chance of this role hitting a limit which is preventing the accelerated search functionality? Let me know if you need any more information.

[jakemcnee95 · Accepted solution]

Solved: We had a search filter setup in the restrict search section of the role editor. This search filter was blocking the report from being accelerated.