Splunk Search

Old Index Old Sourcetype New Field - Search Issues

hkchew
New Member

Hi all,

I have used back the old index & sourcetype but i have re-created new field names for my dashboard.
when using the dashboard, i will see the new fields but the rest of my team will see the old fields.
How can I resolve this? Please advise.
Thank you very much

Eg.
old index = "ABC"
old sourcetype = "DDD"
old fieldname = "DDD_XXX"

old index = "ABC"
old sourcetype = "DDD"
new fieldname = "DDD_YYY"

Tags (1)
0 Karma

renjith_nair
Legend

@hkchew , have you set the permissions to the new fields so that others can see ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dkeck
Influencer

HI

could it be that you did not change the permissions of your new field extractions

Check them in Fields » Field extractions » Permissions

0 Karma

hkchew
New Member

Hi dkeck,

permissions have been set to "global".

0 Karma

dkeck
Influencer

Ok, please check if the users have a field extraction in their users folder for your sourcetype/source/host

/opt/splunk/etc/users/username/appname/local/props.conf

sometimes this could interfere with other extractions, when then refer to the same name or field.

Also check if you have these new extractions within your users folder, because then they have not been shared with others.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...