Splunk Search

Search statistics format not shared

harryc42
Explorer

New to this so probably a very basic question....

A user has a query that comes out with a nicely formatted statistics tab when he runs it.

When another user runs the same query the statistics are blank - It appears that the last item is what generates the stats - how do we make this global or share it with the other users ?

 

index=* ERROR host IN(AEMpub01,AEMpub02,AEMpub03, AEMpub04) | top limit=100 AEMError

 

Labels (1)
0 Karma
1 Solution

harryc42
Explorer

Resolved - ty all for the pointers.

This is because Peter has created an entry in props.conf to define AEMerror

XTRACT-message4,AEMError = (?<message4>doPost: )(?P<AEMError>.+)\;\.*

A wholesale copy of props.conf

      from /opt/abanet/splunk/etc/users/markosp/search/local/props.conf

       to /opt/abanet/splunk/etc/users/harryc/search/local/props.conf

solved the problem for me (harryc).

If others already have a props.conf we can probably just add the line.

View solution in original post

0 Karma

harryc42
Explorer

Resolved - ty all for the pointers.

This is because Peter has created an entry in props.conf to define AEMerror

XTRACT-message4,AEMError = (?<message4>doPost: )(?P<AEMError>.+)\;\.*

A wholesale copy of props.conf

      from /opt/abanet/splunk/etc/users/markosp/search/local/props.conf

       to /opt/abanet/splunk/etc/users/harryc/search/local/props.conf

solved the problem for me (harryc).

If others already have a props.conf we can probably just add the line.

View solution in original post

0 Karma

Smashley
Engager

I suspect this user may have a field extracted as 'AEMError' that they have not shared, so only they would get the extracted field results. If they share this then others should be able to benefit (perhaps they can't for lack of permissions?). Alternately one could add  regex to the query above to extract the field before piping to the top command. Running the query in Smart Mode (without the top command) should show AEMError field under the 'interesting fields' section for only that user presumably?

scelikok
Champion

Hi @harryc42,

Is it possible that another user has no permission on the index that has ERROR in particular hosts? Does he/she see events? 

If this reply helps you an upvote is appreciated.

harryc42
Explorer

The search returns hits for anyone, just the formatting of the "stats" tab does not work for anyone except the original author.

 

What is the AEMError  (the very last argument) called ?  Is that a format or an additional table ?  

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!