How to identify the knowledge object related to a field?

[splunk_luis12]

Hi folks,

I have an admin user running a search and he gets results, however I have another users with a custom role with permissions to the same Index but they're unable to get the same results.

This is the an example of the search: 

index=microsoft-logs ValueName="HA173MN"

The custom role gets results with just the index but when adding the ValueName it doesn't get anything.

It seems that the problem is related to the permissions of some knowledge object that creates that field.

Is there a query or an easy way to identify which knowledge object is related to that field to assign the permissions to the custom role?

I appreciate the help.

[richgalloway]

I agree that the custom role needs permission to access the ValueName field.  That should be done by granting access to the app that defines the field.  The trick will be in finding that app.

There is no Easy Button for this.  The community has been asking for something like that for a while.  See https://ideas.splunk.com if you want to add your vote to the issue.

Start with Settings->Fields and search in each menu for the ValueName field.  Then you'll see the app associated with it.