Splunk Search

When a user queries he gets "insufficient permissions to perform this operation", and when I query I get 0 return events

anikeshp7
Path Finder

I have created a lookup test123.csv owned by me and 

A user queries and he gets the error - "User has insufficient permissions to perform this operation. list_workload_pools and select_workload_pools capabilities are required."

When I do the same query I don't get any error but it also return 0 events.  I dont get that error is it because I own the file ?

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

Would highly appreciate thoughts and suggestions on this . 

Labels (4)
0 Karma

dkmcclory
Explorer

This ticket has been open a long time, but just in case someone else runs into it...

Some people include workload  specifications with the URL of a search they've done. When  this occurs, and they share the link with others, then they can get this  error if the other person does not have the right granted to them to select a workload pool. This most often happens when a Splunk admin shares  a link with a non-admin.  The fix is to remove any reference to a workload pool  from the URL.  Or, alternately, you can grant the role of the person running the search to allow them to list  and select workload pools.  But if you do the second one, then anyone with that role can select which workload pool they run in.

dinesh_bendigo
Explorer

For me, the issue was because of workload_pool=standard_perf parameter in the url shared by admin user. As a normal user I dont have permissions to select the WLM pools. So removed that parameter and was able to run searches successfully. 

vgtk4431
Path Finder
0 Karma

anikeshp7
Path Finder

@vgtk4431 Yes the user is trying to execute a Search. Any suggestions how this can be avoided .

0 Karma

vgtk4431
Path Finder

no the error you are giving is not about the lookup, but about the workoad capabilities that the other user does not have

is it trying to execute a search, or to execute a savedsearch are report you've provided ?

 

 

0 Karma

anikeshp7
Path Finder

Any suggestions how the query can be improved  @vgtk4431  

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns. 

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...