topic Re: report not load search command result for users in Splunk Search

report not load search command result for users

indeed_2000 — Sat, 09 May 2020 07:31:03 GMT

Hi
I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully.

FYI:
1-give read permission to all users.
2-report run as report owner.
3-give permission to users to access index.
4-give permission to users to access data model.
5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL
6-As you see i have 2 search, when user delete whatever exist in second search users able to see events.
Any idea?

Re: report not load search command result for users

to4kawa — Sat, 09 May 2020 08:04:07 GMT

Have you checked Search job inspector ?

Re: report not load search command result for users

indeed_2000 — Sat, 09 May 2020 11:54:35 GMT

Yes as I mentioned in 5

Re: report not load search command result for users

shivanshu1593 — Mon, 11 May 2020 10:37:03 GMT

Can you ask the users to try to search the data from the Index, just by writing index=index_name and see what results do they get.

I've seen the issue, where due to multiple roles assigned to the users, sometimes the permissions don't work correctly.

Re: report not load search command result for users

indeed_2000 — Mon, 11 May 2020 13:22:45 GMT

1-when user just search index result show successfully.
2-only one role assign to user.

Any other idea?