topic why user with same role not able to see data in Splunk Search

why user with same role not able to see data

vikramyadav — Fri, 06 Aug 2021 12:54:27 GMT

Hi Guys,

I have created a simple query with stats command and I'm able to see the required results.

If same search is ran by another user he is not able to see results but if that user removes commands from the search query he is able to see events.

I checked permission of that user and it have same roles which I have.

So I beleive it's not a permission issue.

isoutamo — Thu, 05 Aug 2021 22:03:47 GMT

Hi
can you post the query, description of environment (single node, shared environment etc.)?
r. Ismo

vikramyadav — Fri, 06 Aug 2021 04:11:49 GMT

It's a single node. Below is the search query which I'm using.

index=abc host=xyz "Error executed unexpected" | stats count(error_id) as error

If user is running whole seach query he is not able to see results where as if user is not using command he is able to see events.

isoutamo — Fri, 06 Aug 2021 06:05:35 GMT

Can it be hat this error_id field is your own field extraction not shared within app or global level?

vikramyadav — Tue, 10 Aug 2021 13:38:44 GMT

thanks, @isoutamo that worked.