When a user queries he gets "insufficient permissions to perform this operation", and when I query I get 0 return events

[anikeshp7]

I have created a lookup test123.csv owned by me and 

A user queries and he gets the error - "User has insufficient permissions to perform this operation. list_workload_pools and select_workload_pools capabilities are required."

When I do the same query I don't get any error but it also return 0 events.  I dont get that error is it because I own the file ?

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

Would highly appreciate thoughts and suggestions on this . 

[dkmcclory]

This ticket has been open a long time, but just in case someone else runs into it...

Some people include workload  specifications with the URL of a search they've done. When  this occurs, and they share the link with others, then they can get this  error if the other person does not have the right granted to them to select a workload pool. This most often happens when a Splunk admin shares  a link with a non-admin.  The fix is to remove any reference to a workload pool  from the URL.  Or, alternately, you can grant the role of the person running the search to allow them to list  and select workload pools.  But if you do the second one, then anyone with that role can select which workload pool they run in.

[dinesh_bendigo]

For me, the issue was because of workload_pool=standard_perf parameter in the url shared by admin user. As a normal user I dont have permissions to select the WLM pools. So removed that parameter and was able to run searches successfully. 

[vgtk4431]

https://docs.splunk.com/Documentation/Splunk/8.0.6/Workloads/Useworkloadmanagement

https://docs.splunk.com/Documentation/Splunk/8.0.6/Workloads/Configureworkloadmanagement

I believe they are trying to assign the search to a specific workload without the proper right...

[anikeshp7]

@vgtk4431 Yes the user is trying to execute a Search. Any suggestions how this can be avoided .

[vgtk4431]

no the error you are giving is not about the lookup, but about the workoad capabilities that the other user does not have

is it trying to execute a search, or to execute a savedsearch are report you've provided ?

[anikeshp7]

Any suggestions how the query can be improved  @vgtk4431  

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns. 

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time