Reporting

Why am I getting error "DispatchManager: The user 'admin" does not have sufficient search privileges" after copying custom app from Splunk 4.3 to 6.2?

hartfoml
Motivator

I copied the app from my 4.3 server to my 6.2 server and did the https://MyServer:8000/en-US/debug/refresh

The app was there and now i am getting this kind of error In handler 'savedsearch': Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges

When I run the saved search in the app of in the search app it works so I know I have access to the data but the DispatchManager is not letting the search run in the app.

0 Karma
1 Solution

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

View solution in original post

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

djamieson99
Observer

Hi, 

 

was wondering if someone could explain the owner = admin removal from default.meta in more detail today. Very new to all of this and trying to problem shoot some issue with BOTS.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...