Create saved search via javascript, for user that does not have saved search create rights




Our app has a functionality where users can create alerts for specific events. Unfortunately the users do not have the rights to create saved searches (we are on a multi-tenant platform, so we cannot change user rights). 

The code for this is:


var service = mvc.createService(); 
var mySavedSearches = service.savedSearches();
mySavedSearches.init(admin_service, {app:"APP", sharing:"app"});

// Create a saved search/report as an alert.
// service.savedSearches().create(alertOptions, function (err, alert) {

mySavedSearches.create(alertOptions, function (err, alert) {
  // Error checking.
 if (err && err.status === 409) {
  console.error("ERROR: A saved alert with the name '" + + 
  "' already exists");
  } else if (err) {
  console.error("There was an error creating the alert:", err);

  // Confirmation message.
  console.log("Created alert: " +;


When logged in as an admin user, the saved searches are created. However, when logged in as a normal user, the following error appears:


User 'user' with roles { db_connect_user, user } cannot write: /nobody/APP/savedsearches/test_saved_search { read : [ admin, user ], write : [ admin ] }, export: app, removable: no, modtime: 1559130962.504602000


Would it be possible to create these saved searches as admin, by for instance creating a service with the admin user? How could I do this? I have tried:


var service = mvc.createService({ owner: "admin" })


but this did not work.

Labels (1)
0 Karma

Revered Legend

Splunk JDK is taking credentials of currently logged in user so, since your regular "user" do not have sufficient permissions, they will not be able to create saved searches and can't create a saved search as some other user (admin in your case). 

Splunk has created different roles so that people with right knowledge get right access. For users who should create an alert, why not give them "power" user access with which they should be able to create alerts. See more details on Splunk user roles here:

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...