https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114409#M3580 <P>Thanks. You were correct. I made sure the indexes were viewable but the fields were private as well.</P> Fri, 25 Oct 2013 18:20:55 GMT james_j_taylor 2013-10-25T18:20:55Z https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114405#M3576 <P>When I run the below query as an admin it returns results however when run as a user it does not. The user is a power user with admin rights, the time picker is set the same. There are no exclusions from the users rights to indexes ( as far as I can tell)</P> <PRE><CODE>index="login_data" sourcetype="Login_Data"[search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID ] | eval SignonID=upper(SignonID) | bucket _time span=1d | stats count as LoginCount by _time, SignonID | join type=outer SignonID [search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID EMP_NAME ] | timechart values(LoginCount) as LoginCount by EMP_NAME </CODE></PRE> Thu, 24 Oct 2013 22:05:18 GMT https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114405#M3576 james_j_taylor 2013-10-24T22:05:18Z https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114406#M3577 <P>What does the job inspector say (little 'i' icon near the time picker)? </P> <P>Could some field extraction take place in an app's props or transforms, and the user-role does not have access there?</P> Fri, 25 Oct 2013 06:54:36 GMT https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114406#M3577 kristian_kolb 2013-10-25T06:54:36Z https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114407#M3578 <P>It looks like the search should work providing the user has access to all the same knowledge objects and indexes.<BR /> Check try the following 2 searches. </P> <PRE><CODE>index="login_data" sourcetype="Login_Data | stats count by SignonID index="hrxref_data" sourcetype="HR_XREF" | stats values(LVL1_MOID) values(MOID) values(SignonID) values(EMP_NAME) </CODE></PRE> <P>If any of the searches or columns are empty, look to see if the user can see the index and that field extractions are not private.</P> Fri, 25 Oct 2013 09:28:32 GMT https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114407#M3578 BobM 2013-10-25T09:28:32Z https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114408#M3579 <P>Field extractions were private. I thought since I added the admin role that the role would share the same objects. For this project I changed the objects to global.</P> Fri, 25 Oct 2013 18:20:04 GMT https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114408#M3579 james_j_taylor 2013-10-25T18:20:04Z https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114409#M3580 <P>Thanks. You were correct. I made sure the indexes were viewable but the fields were private as well.</P> Fri, 25 Oct 2013 18:20:55 GMT https://community.splunk.com/t5/Security/Same-Query-different-user-with-matching-permissions-does-not/m-p/114409#M3580 james_j_taylor 2013-10-25T18:20:55Z