topic Re: Event types are not being applied to events for regular user account in Security

Event types are not being applied to events for regular user account

sephora_it — Wed, 28 Aug 2013 00:07:26 GMT

I've created 5 new eventtypes using our admin account and I can see all 5 of them when I perform a search.

When I log in as a regular user, I can only see one of the eventtypes being applied to events. The other 4 eventtypes are not being applied at all as if they do not exist. When I check the eventtypes from the Manager, I can see all 5 of them and confirm that I have permissions to them.

I do not see any difference in the configuration or permissions for the one eventtype that is working compared to the other 4. Why are the other eventtypes not working?

Re: Event types are not being applied to events for regular user account

kristian_kolb — Wed, 28 Aug 2013 00:41:17 GMT

Does your 'normal' user have access to the underlying data? If so, is is searched by default? See Manager -> Access Controls -> Roles -> your_role. At the bottom of the page you can see what indexes are allowed for that role, and which are searched by default.

Re: Event types are not being applied to events for regular user account

sephora_it — Wed, 28 Aug 2013 00:45:10 GMT

Yes, the user has access to the data. I can view the events, but the events are missing the eventtype.

It's identical to what I see using my admin account except it's missing the eventtype.

Re: Event types are not being applied to events for regular user account

rturk — Wed, 28 Aug 2013 05:38:23 GMT

Hi Sephora_it,

Sounds like it's troubleshooting time 🙂 Off the top of my head:

Have you tried running the exact search that you used for the eventtype definitions as the regular user?
Do the regular users have access/permissions to the apps the extract the field names you used in your eventtype definitions?
Do the regular users have access/permissions to the app that the eventtype definitions were made in?

These are just a few of the things I would l start with.

Let me know how you go 🙂

Re: Event types are not being applied to events for regular user account

chimbudp — Mon, 28 Sep 2020 14:40:08 GMT

You might created new Event types from 'SEARCH' application.

The new event types configurations will reside under \etc\apps\search\local

If you try to use the event types which you created under some other application it will not be visible.

Either from 'Splunk Web' you ought to grant permission to "All apps" - So other applications also have visibility to that event types.
or Copy the eventtypes.conf files from the \etc\apps\search\local
to the application \etc\apps\your_app_name\local

Make sure the users had access to application

If all done , users must definitely can able to see that event types.

Re: Event types are not being applied to events for regular user account

sephora_it — Wed, 28 Aug 2013 20:26:55 GMT

Yes to all of the questions above. I've allowed permissions for all Apps.