Security
Highlighted

Sharing field extraction, saved search or dashboard between users

Explorer

Hi,

If a user defines a field extraction, saved search or dashboard, will those be available to other users with the same role?

Thanks!

Tags (2)
0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Communicator

Yes, to the same role. You can read more about users and roles here http://www.splunk.com/base/Documentation/latest/Admin/Aboutusersandroles

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Communicator

User-defined field extractions, saved searches, and dashboards are NOT available to other users by default, even users of the same role. In order to make an object visible to others, the creator must share it to an app and grant read permission to the desired roles.

This can be done in Manager by clicking the Permissions link next to an object.

For more information, please refer to the docs

Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Explorer

I have granted global read/write permissions to a field extraction, however when a user other than the one who created the extraction runs the search, it does not show up for them. Any ideas?

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Communicator

@shawnbeard: does the user in question have read access to the app containing the field extraction?

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Explorer

@ewoo yes they do, Its the search app. I gave the role they belong to read/write access to that extraction. Still only works for the owner. Also Im ad admin and the extractions dont show up for me either.

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Explorer

Im an admin and it doesnt work for me either.

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Communicator

Im an admin and it doesnt work for me either.

Are you saying the field extraction just doesn't work at all, even for admin? Or it works when it is private, then stops working when it is shared to the app level?

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Explorer

@ewoo It works for the user who created the field extraction, but no one else including the admin(me) I currently tried sharing at app level and global level and it still has made no difference.

0 Karma
Highlighted

Re: Sharing field extraction, saved search or dashboard between users

Communicator

Some questions, to help narrow things down:

  • is the user running a search that explicitly requires the field in question, e.g. "* | fields + myfield" ... or is the user running an "exploratory" search?
  • if "exploratory": is it possible that the user in question has other field extractions in effect, causing this specific field extraction to be skipped due to the default system limit on extractions?'
  • is the user in question running an event-based search or a reporting search?
  • if event-based: is the user running the search in smart, verbose, or fast mode?
  • if fast mode: does the extraction work if the user runs in verbose mode instead?
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.