topic Re: Sharing field extraction, saved search or dashboard between users in Security

Sharing field extraction, saved search or dashboard between users

Eldad — Wed, 20 Apr 2011 12:42:27 GMT

Hi,

If a user defines a field extraction, saved search or dashboard, will those be available to other users with the same role?

Thanks!

Re: Sharing field extraction, saved search or dashboard between users

netwrkr — Wed, 20 Apr 2011 12:49:31 GMT

Yes, to the same role. You can read more about users and roles here http://www.splunk.com/base/Documentation/latest/Admin/Aboutusersandroles

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 09 Jun 2011 23:20:54 GMT

User-defined field extractions, saved searches, and dashboards are NOT available to other users by default, even users of the same role. In order to make an object visible to others, the creator must share it to an app and grant read permission to the desired roles.

This can be done in Manager by clicking the Permissions link next to an object.

For more information, please refer to the docs

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 22:37:11 GMT

I have granted global read/write permissions to a field extraction, however when a user other than the one who created the extraction runs the search, it does not show up for them. Any ideas?

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 21 Jul 2016 22:51:13 GMT

@shawnbeard: does the user in question have read access to the app containing the field extraction?

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 22:54:20 GMT

@ewoo yes they do, Its the search app. I gave the role they belong to read/write access to that extraction. Still only works for the owner. Also Im ad admin and the extractions dont show up for me either.

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 22:54:48 GMT

Im an admin and it doesnt work for me either.

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 21 Jul 2016 23:05:07 GMT

Some questions, to help narrow things down:

is the user running a search that explicitly requires the field in question, e.g. "* | fields + myfield" ... or is the user running an "exploratory" search?
if "exploratory": is it possible that the user in question has other field extractions in effect, causing this specific field extraction to be skipped due to the default system limit on extractions?'
is the user in question running an event-based search or a reporting search?
if event-based: is the user running the search in smart, verbose, or fast mode?
if fast mode: does the extraction work if the user runs in verbose mode instead?

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 21 Jul 2016 23:07:29 GMT

Im an admin and it doesnt work for me either.

Are you saying the field extraction just doesn't work at all, even for admin? Or it works when it is private, then stops working when it is shared to the app level?

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Tue, 29 Sep 2020 10:21:01 GMT

@evoo its a very simple general search:
index="dice_loadtest" source="/usr/local/logs/jmeterLogs/fullTest_07-21+11:51:02.jtl"

The users in question both have the same roles with access to the same search indexes. It defaults to smart mode for both users. Only difference is the one user created the extraction. So for him, the fields show up for anyone else, including me, they dont despite the global read/write permissions to "Everyone"

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 23:19:58 GMT

@ewoo It works for the user who created the field extraction, but no one else including the admin(me) I currently tried sharing at app level and global level and it still has made no difference.

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 21 Jul 2016 23:20:00 GMT

Does the field extraction work for you (admin) if you modify the search string to require the extracted-field explicitly -- e.g. index=dice_loadtest source=*.jtl myfield=* | fields + myfield ...?

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 23:31:30 GMT

@ewoo no running this shows no extracted fields at all. When I select Extract Fields i get an error: The events associated with this job have no sourcetype information: 1469143490.1775

Also whats odd is as an admin I cant even tell what he is extracting. When i go to Fields-->Field extractions for his user account, I see this:

jmetter_logs: REPORT-LoadTest1 Type: User transform Extraction/Transform: Report-LoadTest1 selecting it I cant see what its doing

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 23:32:11 GMT

Thats Uses Transform

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Thu, 21 Jul 2016 23:41:05 GMT

Thats Uses Transform

Oh, this prop references a transform? Does the field extraction work for other users if the associated transform also has its permissions set appropriately (share to app, set read permissions) ...?

My understanding is that, if you create a field extraction via the UI that references a transform, then share the extraction via the UI, the associated transform is left private. I believe this is a known issue (internal bug: SPL-118752).

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Thu, 21 Jul 2016 23:58:11 GMT

that I dont know. How would I change the permissions on the associated transform?

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Fri, 22 Jul 2016 00:02:11 GMT

How would I change the permissions on the associated transform?

Settings > Fields > Field transformations > yourtransform > Permissions

Re: Sharing field extraction, saved search or dashboard between users

shawnbeard — Fri, 22 Jul 2016 00:09:18 GMT

@ewoo Im not finding any transaforms for this, or any associated with the search app.

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Fri, 22 Jul 2016 00:20:35 GMT

that I dont know. How would I change the permissions on the associated transform?

Settings > Fields > Field transformations > yourtransform > Permissions

(Sidenote: I recreated this comment as a new "thread". Adding new comments to the existing thread doesn't seem to be working ...)

Re: Sharing field extraction, saved search or dashboard between users

ewoo — Fri, 22 Jul 2016 00:22:52 GMT

If you can't find "yourtransform" in the "Field transformations" listing, it might be worth looking at the field extraction directly, to see what transform it references -- Settings > Fields > Field extractions > jmetter_logs : REPORT-LoadTest1