Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Why are field values in a dashboard not visibl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
We have this issue in our environment where in one of the dashboards, field values of the extracted fields (numbers) are not visible to the users.
But the same value appears in the dashboard when i login as an admin.
I verified the permission of the role which seems to be fine and i have also increased value of the concurrent search for the user role but no luck..
any thoughts..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Setting the permissions for the fields from field extraction did the trick..thanks a lot !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome. Please accept the helpful answer, then.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is the sharing permission on the field extraction that has been setup (assuming) allows that user's role to read?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
data from the same extracted fields is been read by the user role in a different dashboard....also am not sure how to check the sharing option on the extracted field.
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
