How a different users can get different results for the same query?

[Madhan45]

for example user1 and user2 are running the the below query and user1 is getting results as 10 events, where as user2 is getting "no results found".

index=test "Welcome to pune"

How it is possible? could it be any problem between search head and indexer?

[sohailmohammed]

Hey Madhan45,

Did you resolve this issue ? I am facing the same issue here. I have users with same roles but gives different results on same search head. 

Please let me know

[rusty009]

Are you using a distributed environment? If so, which admin to which component of Splunk cannot return the results? This will make a difference. At first glance, I would say this is a permissions issue if one user can access the data and another can't, it would also be useful to see your full search query and to make sure you are running the searches from the same app in Splunk, just in case you're relying on any app specific commands/lookups.

To see which users have access to which indexes you will need to run the below as an admin on the searchead, I would also run it as the user who can see the data,

| rest /services/authentication/users | rename title AS username roles AS role | mvexpand role | fields realname username role | join type=outer role [ rest /services/authorization/roles | rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ") | fields role indexes] | table username role indexes

This will gives you a list of permissions. let me know how you get on.

[PPape]

Maybe user 1 has the rights to access index test and user 2 hasn't?
Please try index=test with user2 and see if it brings back any events.

[Madhan45]

I tried that one as well. it didn't work but when i specify the host that is ( index=test host=PC1234 "Welcome to pune") , im getting results.

What could be the problem?

[PPape]

Can you pastebin the searchlogs? You can find them when you click on inspect job.

please from user1 + user 2
index=test "Welcome to pune"

and from user1 + user 2
index=test host=PC1234 "Welcome to pune"

[Madhan45]

Im facing this issue on client machine so i cannot share those logs.
And most interesting problem is admin user is not getting the results, normal users is getting some results.
So how when we specify host name we are getting those logs.?

[PPape]

Sorry without the logs I can't do anything. I tried to reproduce it here but that doesnt work. Maybe someone else could help you more. Im sorry.

[Madhan45]

That's ok.. thanks