Security

Facing Issues To Run A Report On User Access

saibal6
Path Finder

Hi Experts,

I have admin permission to login into the splunk. So whenever I run a report, it's taking hardly 2 seconds or less than that. So i have shared that report with user only read access mode. But whenever user is trying to run that report it's showing an message that "waiting for queued job to start Manage Jobs".

Could anyone help me on this matter? What should I do in this case or how can I troubleshoot this issue?

If you need more info in this matter, please let me know.

Thanks,
@saibal6

0 Karma

woodcock
Esteemed Legend

The user has used up to much disk quota for his search results. Have him click on the Jobs link and delete all of his search job artifacts and then his search will run. Then educate him not to run searches that generate gobs of results, because this will consume his disk quota.

0 Karma

tom_frotscher
Builder

Hi,

the user role is per default limited to a small amount of searches that run in parallel and the results of a user can also only take limited space in the splunk dispatch folder. The lifetime of a search is 10min. As an example: A user starts a search which returns alot of results, so the 100mb space in the dispatch folder is used up. The user have to wait 10min until the lifetime ends and the search is removed from dispatch folder. You can edit those values in settings -> access control -> roles, there you can select the role you want to edit.

The options "User-level concurrent search jobs limit", "User-level concurrent real-time search jobs limit", and "Limit total jobs disk quota" are of interest in your case. You can increase them, but this will increase the load of your splunk machines if the user make heavy use of more searches.

Greetings

Tom

0 Karma
Get Updates on the Splunk Community!

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...