Dashboards & Visualizations

Why are field values in a dashboard not visible to users?

Engager

Hi All,
We have this issue in our environment where in one of the dashboards, field values of the extracted fields (numbers) are not visible to the users.

But the same value appears in the dashboard when i login as an admin.

I verified the permission of the role which seems to be fine and i have also increased value of the concurrent search for the user role but no luck..

any thoughts..

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

View solution in original post

SplunkTrust
SplunkTrust

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

View solution in original post

Engager

Setting the permissions for the fields from field extraction did the trick..thanks a lot !

0 Karma

SplunkTrust
SplunkTrust

Awesome. Please accept the helpful answer, then.

0 Karma

SplunkTrust
SplunkTrust

Is the sharing permission on the field extraction that has been setup (assuming) allows that user's role to read?

0 Karma

Engager

data from the same extracted fields is been read by the user role in a different dashboard....also am not sure how to check the sharing option on the extracted field.

0 Karma