Field extraction invisible to other users despite global permission

[AWED]

With splunk 4.1.6 : a user has defined a custom field extraction in the "search" app. As as admin, I have changed the permissions on that to be "all apps" with "Everyone" having read permission.

Despite that, when searching within the search app., that field is still only showing as being extracted for the user who created it, not for anyone else.

I then moved the field extraction to a custom app, but still cannot access it even when running searches within that app.

Any suggestions?

[chimell]

Hi AWED
Go verify the capabilities of the user role .Because it can limit the action of user.
you could go to Settings > Access control > Role and you will see Selected capabilities. For example Admin_all_objects capability mean that the user who has this role can manage all the objects.

Tell me if it work like you want

[hulahoop]

Is the field extraction an inline extraction (e.g. EXTRACT-foo = ...)?

[vbumgarn]

Those settings are actually stored in a file called local.meta, at $SPLUNK_HOME/etc/apps//metadata/local.meta

You should an entry like this:

[props/OSS_TL1/EXTRACT-sessionOpenClose]
access = read : [ * ]
export = system
owner = userName

I believe the important bits are the "export = system" and "access = read : [ * ]"

Does your local.meta look similar to that?

[AWED]

Yes, the file is there and it does look like that.

So what do we do now? There is clearly some other issue.

[fabiocaldas]

AWED, did you got any solution? I'm facing same problem to a role group