Check Splunk User Account Permissions.
To check permissions for an account level, use this procedure:
- Click the Settings menu in the upper-right corner, then click Access Controls.
- On the Access Controls page, click Users.
- On the Users page, examine the Roles column. Any user who needs to use the Enrich or Submit actions requires Admin as one of their account roles.