I feel that his may be an obscure question, but I have nothing to lose by asking.
There have been one or two previous questions about the jobs listed as being dispatched on 12/31/69:
https://answers.splunk.com/answers/321611/why-are-jobs-showing-as-dispatched-at-123169-and-k.html
For me, these searches are showing up from one user specifically, whose account does not have as many rights or capabilities as the other users. If that users's work is done on another account, the 1969 searches do not appear. Specifically, I'm using the JavaScript SDK to connect to our splunk instance and make searches every few minutes. If I use my own credentials to connect to Splunk and run the searches, there are no issues. However, if I use the account with fewer capabilities to make the connection, the 1969 searches begin to appear and prevent us from continuing to make new searches.
Is there a specific capability that I could give to the errant user account that might make the difference?
↧