Splunk Search

How to identify the knowledge object related to a field?

splunk_luis12
Path Finder

Hi folks,

I have an admin user running a search and he gets results, however I have another users with a custom role with permissions to the same Index but they're unable to get the same results.

This is the an example of the search: 

index=microsoft-logs ValueName="HA173MN"

The custom role gets results with just the index but when adding the ValueName it doesn't get anything.

It seems that the problem is related to the permissions of some knowledge object that creates that field.

Is there a query or an easy way to identify which knowledge object is related to that field to assign the permissions to the custom role?

I appreciate the help.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I agree that the custom role needs permission to access the ValueName field.  That should be done by granting access to the app that defines the field.  The trick will be in finding that app.

There is no Easy Button for this.  The community has been asking for something like that for a while.  See https://ideas.splunk.com if you want to add your vote to the issue.

Start with Settings->Fields and search in each menu for the ValueName field.  Then you'll see the app associated with it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...