Why are field values in a dashboard not visible to users?

[srisplunk12]

Hi All,
We have this issue in our environment where in one of the dashboards, field values of the extracted fields (numbers) are not visible to the users.

But the same value appears in the dashboard when i login as an admin.

I verified the permission of the role which seems to be fine and i have also increased value of the concurrent search for the user role but no luck..

any thoughts..

[somesoni2 · Accepted solution]

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

[srisplunk12]

Setting the permissions for the fields from field extraction did the trick..thanks a lot !

[DalJeanis]

Awesome. Please accept the helpful answer, then.

[somesoni2]

Is the sharing permission on the field extraction that has been setup (assuming) allows that user's role to read?

[srisplunk12]

data from the same extracted fields is been read by the user role in a different dashboard....also am not sure how to check the sharing option on the extracted field.