"You do not have permission to spawn real-time searches"

[matthewcanty]

Where do I find the settings to allow a user to have permission to "spawn" real-time searches?

EDIT:

What settings do I need to change. Can't see any specific "Allow real-time searches"...

[yannK · Accepted solution]

as an admin in the manager > access control > roles

[yannK]

thanks for the last part Drainy.

[matthewcanty]

Ah yes I see it now.

Manager > Access Controls > Roles > role > Capabilities > Select rtsearch

[Drainy]

you need them to have the rtsearch capability. Have a read of http://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities

[matthewcanty]

I got that far. What setting do I need to change?