topic Search statistics format not shared in Splunk Search

Search statistics format not shared

harryc42 — Tue, 20 Apr 2021 11:48:22 GMT

New to this so probably a very basic question....

A user has a query that comes out with a nicely formatted statistics tab when he runs it.

When another user runs the same query the statistics are blank - It appears that the last item is what generates the stats - how do we make this global or share it with the other users ?

index=* ERROR host IN(AEMpub01,AEMpub02,AEMpub03, AEMpub04) | top limit=100 AEMError

Re: Search statistics format not shared

scelikok — Wed, 21 Apr 2021 04:18:45 GMT

Hi @harryc42,

Is it possible that another user has no permission on the index that has ERROR in particular hosts? Does he/she see events?

Re: Search statistics format not shared

harryc42 — Wed, 21 Apr 2021 11:17:14 GMT

The search returns hits for anyone, just the formatting of the "stats" tab does not work for anyone except the original author.

What is the AEMError (the very last argument) called ? Is that a format or an additional table ?

Re: Search statistics format not shared

Smashley — Wed, 21 Apr 2021 12:43:52 GMT

I suspect this user may have a field extracted as 'AEMError' that they have not shared, so only they would get the extracted field results. If they share this then others should be able to benefit (perhaps they can't for lack of permissions?). Alternately one could add regex to the query above to extract the field before piping to the top command. Running the query in Smart Mode (without the top command) should show AEMError field under the 'interesting fields' section for only that user presumably?

Search statistics format not shared

harryc42 — Fri, 23 Apr 2021 18:12:56 GMT

Resolved - ty all for the pointers.

This is because Peter has created an entry in props.conf to define AEMerror

XTRACT-message4,AEMError = (?<message4>doPost: )(?P<AEMError>.+)\;\.*

A wholesale copy of props.conf

from /opt/abanet/splunk/etc/users/markosp/search/local/props.conf

to /opt/abanet/splunk/etc/users/harryc/search/local/props.conf

solved the problem for me (harryc).

If others already have a props.conf we can probably just add the line.