Splunk Search

Field extraction permissions questions



If I create a field extraction in the context of App1 and set the permissions as Global and give Everyone read permissions, should the fields be visible in searches in App2?

I had this situation recently and nothing I did could change anything until I moved the field extraction from App1 to App2 and then the user who only can access App2 was able to see the fields in search.

Is there somewhere where all this is clearly documented?



Labels (1)



0 Karma
Get Updates on the Splunk Community!

Cannot push config from deployer to search head cluster

Hello,I recently upgraded our deployer/deployment server from 8.1.6 to version 9.0 and when I try to push ...

Clear text password in command line

mogod command line argument having clear text password like "--sslPEMKeyPassword=password"how to avoid clear ...

Traffic logs from Splunk Add-on for Cisco Meraki

Recently deployed this add-on, but it doesn't seem to bring back Traffic or URL logs like we did when using ...