topic search result issue by users in Splunk Search

search result issue by users

moonyoungjung — Thu, 29 Aug 2019 05:41:35 GMT

Same SPL result is different by user A and admin

SPL-> index=xxx

when I do search with userA's userid

"interesting fields" when searching with userA's ID and the results when searching with admin are different

so I was create new userID -> userB and assigned same role as userA
userB's search result is exactly the same result as admin

how to fix userA's search result problem?

admin result

UserA result

I was look up field1 value.
field1 is dst_ip

solarboyz1 — Fri, 30 Aug 2019 15:23:17 GMT

Users can create private knowledge objects for parsing events. If so, it would only impact that user.

Via the UI, you can look for private objects (field extrations, sourcetype renames, etc..) owned by userA:
Settings -> All Configuraitons

Or check the config files in their user directory $SPLUNK_HOME/etc/users/userA

moonyoungjung — Mon, 02 Sep 2019 06:25:19 GMT

I appreciate your help.

solarboyz1 — Tue, 03 Sep 2019 12:46:53 GMT

Did it work?

moonyoungjung — Wed, 04 Sep 2019 06:43:04 GMT

I appreciate your help !!

solarboyz1 — Wed, 04 Sep 2019 13:04:21 GMT

Glad it it worked for you!