Dashboards & Visualizations

Why are field values in a dashboard not visible to users?

srisplunk12
Engager

Hi All,
We have this issue in our environment where in one of the dashboards, field values of the extracted fields (numbers) are not visible to the users.

But the same value appears in the dashboard when i login as an admin.

I verified the permission of the role which seems to be fine and i have also increased value of the concurrent search for the user role but no luck..

any thoughts..

0 Karma
1 Solution

somesoni2
Revered Legend

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

View solution in original post

somesoni2
Revered Legend

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

View solution in original post

srisplunk12
Engager

Setting the permissions for the fields from field extraction did the trick..thanks a lot !

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Awesome. Please accept the helpful answer, then.

0 Karma

somesoni2
Revered Legend

Is the sharing permission on the field extraction that has been setup (assuming) allows that user's role to read?

0 Karma

srisplunk12
Engager

data from the same extracted fields is been read by the user role in a different dashboard....also am not sure how to check the sharing option on the extracted field.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!