Only one user does NOT see all fields

[kmattern]

I have an app that has a few views in it. In each of these views there is a table of search results, based on drilldown. Every user, with the exception of only one person, sees all the data in each column of the tables. On at least two views this one user (my boss, of course) cannot see the content of all fields in the table. These particular columns are blank for him but everyone else sees the data.

I have checked permissions on all extracted fields and they are all global.
I have had him use someone else's computer to eliminate his computer. The same happened there.
We use SSO through LDAP to access the views. I had the administrator give my boss privileges identical to myself with no change in results.

I'm at my wits end. If anyone has a suggestion I'll be happy to entertain it.

I don't think Sideview Utils has anything to do with this but we use Sideview in all our apps.

[andrewkenth]

Also, try recreating his user (clones from someone in the same role as him). I had this issue (w/ someone using IE..) and it solved his issues.

[kmattern]

Been there, done that

[kmattern]

I'll try that.

[aelliott]

Could this possibly be a state corruption issue? Do your dashboards save state?

That is the only thing that is user specific and is server side that I can think of.

$SPLUNK_HOME\etc\users\UserName\AppName\local\viewstates.conf Then remove all data in that file (note this will remove all saved preferences within this app)

[kmattern]

As I said, he tried a different browser and even a different computer, on which another user had the same access to the same app. He couldn't see all the fields there either.

[aholzer]

Different browser might be your problem. I have had issues in the past with users working in IE and not being able to view things that appear just fine in Chrome or Firefox. Either install a new browser on his computer or have him try from your computer and see if that's the problem.

[sideview]

How are the fields in question defined - what commonality is there. Are the fields there as a column in the results or are the columns missing entirely? Is the search result coming from a saved search? are there any vestigial viewstate stanzas in his account for that savedsearch or that view?
It'll be something simple but insane like an authorize.conf stranded in some weird directory but where splunkd is still picking it up.

[aelliott]

Have you attempted to delete him and recreate.

[kmattern]

Different browser, different computer.

[kmattern]

I have over 50 apps that my boss has access to. He has no trouble with any other. He, as are all non admin users, is restricted to only apps he is assigned to. No user, other than admin, can make a private copy of a view, lookup table, extracted field or anything else. He does not get a search bar. This is a DoD site so access is based on need to know. His Splunk access was set to match mine exactly and it still didn't work.

[aholzer]

This is where I'd start:
- Does your boss have a role that you don't have? If so, check to ensure the role doesn't have a filter configured on it, or limited access to certain indexes
- Is your boss logging in to the same search head that everyone else is? The search peers might be different
- Has your boss perhaps made a private copy of the dashboard that doesn't include those fields, and when he runs it uses his private dashboard rather than the global one? check similarly for macros / fields / saved searches
- Are you using a lookup that isn't set to global permissions?

Hope this helps