Talbot7: The ability to manage sharing permissions for knowledge objects (such as saved searches, alerts, dashboards, tags, event types, and so on) is controlled at the app level. There are no capabilities involved.
As an Admin, click the Apps menu in the Splunk bar and click Manage Apps. Find the app that you want to adjust permissions for and open its Permissions settings. This opens the Permissions dialog for the app, where you determine which roles have read and write permissions for the knowledge objects contained within that app. Give your User role Write permissions for the app if you want them to be able to share knowledge objects such as saved searches.
Warning: Roles that have write permissions to an app can also delete knowledge objects belonging to that app.
For future reference I've added documentation about this functionality here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions#Enable...
