Splunk Search

How to identify the knowledge object related to a field?

splunk_luis12
Path Finder

Hi folks,

I have an admin user running a search and he gets results, however I have another users with a custom role with permissions to the same Index but they're unable to get the same results.

This is the an example of the search: 

index=microsoft-logs ValueName="HA173MN"

The custom role gets results with just the index but when adding the ValueName it doesn't get anything.

It seems that the problem is related to the permissions of some knowledge object that creates that field.

Is there a query or an easy way to identify which knowledge object is related to that field to assign the permissions to the custom role?

I appreciate the help.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I agree that the custom role needs permission to access the ValueName field.  That should be done by granting access to the app that defines the field.  The trick will be in finding that app.

There is no Easy Button for this.  The community has been asking for something like that for a while.  See https://ideas.splunk.com if you want to add your vote to the issue.

Start with Settings->Fields and search in each menu for the ValueName field.  Then you'll see the app associated with it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...