Report shows missing fields after owner reassignment (Splunk Cloud)

[tomapatan]

Report (saved search) originally owned by me and running correctly

Created a new role and user to access the report via REST API

Granted the role access to the relevant indexes

Used Reassign knowledge objects to change the report owner to the new user (new owner now shows correctly)

Problem
When I run the report as myself: all expected fields are present.

When I log in as the new user (who also owns the report) and run the same report: some fields are missing from results.

The search completes without an obvious error - just that some fields have no values.

I could write an inline regex to extract the fields, but I`m intrigued by the problem...

[richgalloway · Accepted solution]

The new user/role has access to the report and indexes, but what about the other KOs used by the report?  Double-check the permissions settings for any calculated fields, lookups, aliases, etc.

[isoutamo]

This sounds like @richgalloway said. You have defined some other KOs like field extraction inline or transforms. Maybe eventtypes and/or macros which are private or if those are public, other user’s role hasn’t permissions to see and use those.