We recently moved Splunk Security Essentials from our lab to our QA environment, but it is not working. In Lab we have admin privs, but in QA it is only power user privs and we did enable the _list settings permissions for our roles as suggested by another post. It still will not populate. Any other suggestions? Here is the error.
External search command 'sseanalytics' returned error code 1. .
