Reporting

odd problem with share report

indeed_2000
Motivator

Hi
I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully.
seem users need to access "RootObject".

FYI:
1-give read permission to all users.
2-report run as report owner.
3-give permission to users to access index.
4-give permission to users to access data model.
5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL

alt text

Any recommendation?
Thanks,

0 Karma

PavelP
Motivator

Hello @mehrdad_2000 ,

try run as user and delete the second pipe and everything after it:

index="masked" | search "masked"

if the user can see results continue with the next set (rename) and so on.

Let me know how it went

0 Karma

indeed_2000
Motivator

As you see i have 2 search, when user delete whatever exist in second search users able to see events.
Any idea?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...