Troubleshoot new users not displaying in the analyst queue

Issue

New users added to Splunk Web might not be displayed for a few minutes in the Owner drop-down on the Analyst queue or when you select a finding from the Analyst queue to view details on the finding in Splunk Enterprise Security.

Cause

The custom roles that you add are populated in the Permissions Manager page of Splunk Enterprise Security within 60 seconds so that you can enable specific access control lists (ACLs).

Solution

Wait for a few minutes so that the new user that you created appears on the Owner drop-down of the Analyst queue and when you view details of a finding on the Mission Control page.

See also

For more information on configuring users and roles in Splunk Enterprise Security, see the product documentation:

• Create and manage users with Splunk Web
• Configure users and roles in Splunk Enterprise Security
• Manage analyst workflows using the analyst queue in Splunk Enterprise Security