Reporting

Why am I getting error "DispatchManager: The user 'admin" does not have sufficient search privileges" after copying custom app from Splunk 4.3 to 6.2?

hartfoml
Motivator

I copied the app from my 4.3 server to my 6.2 server and did the https://MyServer:8000/en-US/debug/refresh

The app was there and now i am getting this kind of error In handler 'savedsearch': Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges

When I run the saved search in the app of in the search app it works so I know I have access to the data but the DispatchManager is not letting the search run in the app.

0 Karma
1 Solution

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

View solution in original post

teunlaan
Contributor

Do you still had a admin user in your config?
We had the same error when updated to 6.2. We have removed the admin account on our systems.

To solve it remove "owner = admin" from the default.meta files

djamieson99
Observer

Hi, 

 

was wondering if someone could explain the owner = admin removal from default.meta in more detail today. Very new to all of this and trying to problem shoot some issue with BOTS.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...