Why would a user be unable to access a globally shared event type?

[adamblock2]

We are currently running a distributed Splunk 6.2.3 environment. A custom app was created on one of our search heads which a limited number of individuals have access to. An event type was created within this app, and the permissions were subsequently updated to allow everyone read access. The details are as follows:

App = custom_app
Sharing = Global
Permissions = Read access was assigned to Everyone

A user who does not have access to the "custom_app" has attempted to access this event type, but was unable. When the user views the available event types (settings/event types), the above event type is not listed.

It was my understanding that since the permissions (sharing) were updated to "Global", users should be able to access the event type even though they do not have access to the app under which it was initially created. Is this not the case?

[somesoni2 · Accepted solution]

The app level permissions (which allows access to certain people/role only) has precedent over the object level permissions (which allows access to Everyone), hence user who doesn't have access to the app can't access anything defined within the app.