I have recently deployed Splunk Cisco ISE app into production and its working well for normal users.But as an admin i'm unable to see the dashboard panels populating.
All the panel searches are based on the eventtype and when I run those searches as an admin Im not getting the results but when I login as a normal test user and run those searches its working fine.
Eg : eventtype=cisco-ise | timechart usenull=f count by MESSAGE_CLASS
This search works for normal user but not with admin login.Im really surprised about this issue.Please let me know where I need to troubleshoot to resolve this issue.
are there fields in the eventtypes?
if you run the search contained in eventtypes forcing the Verbose Mode, do you have results?
maybe it's a Mode problem.
if in Verbose Mode the search has results, move the fields contained in the eventtypes and the field MESSAGE_CLASS from Interesting Fileds in selected Fields and then run the same search in Smart Mode.
If you have results, your dashboard should run.