Splunk Search

When a user queries he gets "insufficient permissions to perform this operation", and when I query I get 0 return events

anikeshp7
Path Finder

I have created a lookup test123.csv owned by me and 

A user queries and he gets the error - "User has insufficient permissions to perform this operation. list_workload_pools and select_workload_pools capabilities are required."

When I do the same query I don't get any error but it also return 0 events.  I dont get that error is it because I own the file ?

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

Would highly appreciate thoughts and suggestions on this . 

Labels (4)
0 Karma

dkmcclory
Engager

This ticket has been open a long time, but just in case someone else runs into it...

Some people include workload  specifications with the URL of a search they've done. When  this occurs, and they share the link with others, then they can get this  error if the other person does not have the right granted to them to select a workload pool. This most often happens when a Splunk admin shares  a link with a non-admin.  The fix is to remove any reference to a workload pool  from the URL.  Or, alternately, you can grant the role of the person running the search to allow them to list  and select workload pools.  But if you do the second one, then anyone with that role can select which workload pool they run in.

dinesh_bendigo
Explorer

For me, the issue was because of workload_pool=standard_perf parameter in the url shared by admin user. As a normal user I dont have permissions to select the WLM pools. So removed that parameter and was able to run searches successfully. 

vgtk4431
Path Finder
0 Karma

anikeshp7
Path Finder

@vgtk4431 Yes the user is trying to execute a Search. Any suggestions how this can be avoided .

0 Karma

vgtk4431
Path Finder

no the error you are giving is not about the lookup, but about the workoad capabilities that the other user does not have

is it trying to execute a search, or to execute a savedsearch are report you've provided ?

 

 

0 Karma

anikeshp7
Path Finder

Any suggestions how the query can be improved  @vgtk4431  

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns. 

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...