Splunk Search
Highlighted

Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Path Finder

Is anyone else getting this error when performing a search? If so, can anyone help with a solution. Thank you

In handler 'savedsearch': Cannot get username when all users are selected.
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Splunk Employee
Splunk Employee

We are seeing it also. Have you had any traction on this error? Are you using LDAP for authentication or a custom script of some sort?

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Contributor

@mgonter_splunk - any updates on this? i am using LDAP auth in a Search Head cluster.

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Contributor

actually to clarify, i was also seeing messages as found here in this question. this answer helped me (was actually a loadbalancing issue).

https://answers.splunk.com/answers/205904/search-head-cluster-error-usermanagerpro-failed-to.html

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Path Finder

Sorry for the delay, my engineer was able to troubleshoot it and provided the following. Please take a look and compare..
Camilla Clone - Jeff

<input type="dropdown" token="card" searchWhenChanged="true">
  <label>Select a User:</label>
  <search>
    <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| stats values(CardholderName) as card | mvexpand card</query>
  </search>
  <fieldForLabel>card</fieldForLabel>
  <fieldForValue>card</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
  <valueprefix>"CardholderName=</valueprefix>
  <valuesuffix>"</valuesuffix>
</input>


<panel>
  <title>$card$</title>
  <table>
    <search>
      <query>sourcetype="Camilla - All Events" $card$ Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description</query>
      <earliest></earliest>
      <latest></latest>
    </search>
  </table>
</panel>

`

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Splunk Employee
Splunk Employee
0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Motivator

That thread mentions that the problem is resolved in 6.3.2, which we are running, but we're still seeing that error come up. There were other users in the thread that said the same. Is there a confirmation that it is now fixed in 6.3.3 or 6.3.4?

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Path Finder

I'm still seeing this as of Splunk 6.5.

0 Karma
Highlighted

Re: Why am I getting search error "In handler 'savedsearch': Cannot get username when all users are selected."?

Motivator

I have also faced this issue while back. After long struggle, figured out the issue is with F5 VIP settings.

please check "sessioncookieinsert' as the default persistence profile". Once we updated this setting above mentioned issue is gone.

I hope this helps you.