topic Re: Report shows missing fields after owner reassignment (Splunk Cloud) in Splunk Dev

Report shows missing fields after owner reassignment (Splunk Cloud)

tomapatan — Fri, 05 Sep 2025 17:26:36 GMT

Report (saved search) originally owned by me and running correctly

Created a new role and user to access the report via REST API

Granted the role access to the relevant indexes

Used Reassign knowledge objects to change the report owner to the new user (new owner now shows correctly)

Problem
When I run the report as myself: all expected fields are present.

When I log in as the new user (who also owns the report) and run the same report: some fields are missing from results.

The search completes without an obvious error - just that some fields have no values.

I could write an inline regex to extract the fields, but I`m intrigued by the problem...

Re: Report shows missing fields after owner reassignment (Splunk Cloud)

richgalloway — Fri, 05 Sep 2025 18:30:57 GMT

The new user/role has access to the report and indexes, but what about the other KOs used by the report? Double-check the permissions settings for any calculated fields, lookups, aliases, etc.

Re: Report shows missing fields after owner reassignment (Splunk Cloud)

isoutamo — Sat, 06 Sep 2025 23:49:22 GMT

This sounds like @richgalloway said. You have defined some other KOs like field extraction inline or transforms. Maybe eventtypes and/or macros which are private or if those are public, other user’s role hasn’t permissions to see and use those.