Dashboards & Visualizations

inputlookup subsearch not working in a dashboard as user other than admin

hugohctint
Loves-to-Learn Lots

sourcetype="SIPPRD" NOT [inputlookup Login_Exclusion_User.csv |fields LOGIN_EXCLUSION_USER] AND NOT [inputlookup Login_Exclusion.csv |fields LOGIN_EXCLUSION] AND NOT [inputlookup Login_Exclusion_OS.csv |fields LOGIN_EXCLUSION_OS] AND ACTION_NAME IN ("LOGON", "LOGOFF", "LOGOFF BY CLEANUP")|table TIMESTAMP, USERNAME, ACTION_NAME,

It run fine as admin as report or dashboard but if misses the input lookup subsearch if it runs as any other user in a dashboard but runs fine on a report under any user. Even I assigned the user to the admin role and still not running.
If a just put the "|inputlookup Login_Exclusion_User.csv |fields LOGIN_EXCLUSION_USER" alone it reads the file correctly.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Check BOTH lookup files to make sure that they are BOTH set to have App and not Private for Sharing.

0 Karma

hugohctint
Loves-to-Learn Lots

I checked and there are all global but still the same result. Ignoring the inputlookup subserch. Any other suggestion? Thanks

0 Karma

ssadanala1
Contributor

Can you try re writing the search like this and try

sourcetype = *SIPPRD ACTION_NAME IN ("LOGON", "LOGOFF", "LOGOFF BY CLEANUP")||table TIMESTAMP , USERNAME,ACTION_NAME |search NOT [inputlookup Login_Exclusion.csv |fields LOGIN_EXCLUSION] |search NOT [inputlookup Login_Exclusion_OS.csv |fields LOGIN_EXCLUSION_OS]

Let know if any this search runs any resultss

0 Karma

hugohctint
Loves-to-Learn Lots

Hi Ssadanala1, It runs with the same results, no difference, still the same issue.

0 Karma

hugohctint
Loves-to-Learn Lots

thanks, any other idea?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...