Alerting

Permission Denied when clicking "view results" on Alert

rohitmaheshwari
Explorer

I have a user who is getting an alert but when he clicks to view the alert he is able to go to the alert page, but when he clicks on "view results" on the alert page it takes him to search bar and says permission denied.

He has access to the index where this alert is set up. He is also able to see the results pop up when he pastes the alert search query on the search bar. He also has access to the application and this alert is shared in the app.

His permissions: Power User

What can I do so that this user is able to see the results when clicking on the "View Results" button on the alert page.

Your help is much appreciated.

Thanks,
Rohit

Tags (1)
0 Karma

jodyfsu
Path Finder

Alerts and Reports have their own permissions. When you create one you will need to set the permission even if the user has access to the index.

alt text

0 Karma

rohitmaheshwari
Explorer

This is how it is set up on the Alert.

Everyone has read permission to it. But still when the "View results" hot button is clicked on the alert page. It takes the user to the search bar but displays "Permission denied".

I am thinking there might be some custom setting for this but I can't figure it out yet.

0 Karma

jodyfsu
Path Finder

Hmm.. sorry I do not have any other ideas here...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...