Search statistics format not shared

[harryc42]

New to this so probably a very basic question....

A user has a query that comes out with a nicely formatted statistics tab when he runs it.

When another user runs the same query the statistics are blank - It appears that the last item is what generates the stats - how do we make this global or share it with the other users ?

index=* ERROR host IN(AEMpub01,AEMpub02,AEMpub03, AEMpub04) | top limit=100 AEMError

[harryc42 · Accepted solution]

Resolved - ty all for the pointers.

This is because Peter has created an entry in props.conf to define AEMerror

XTRACT-message4,AEMError = (?<message4>doPost: )(?P<AEMError>.+)\;\.*

A wholesale copy of props.conf

      from /opt/abanet/splunk/etc/users/markosp/search/local/props.conf

       to /opt/abanet/splunk/etc/users/harryc/search/local/props.conf

solved the problem for me (harryc).

If others already have a props.conf we can probably just add the line.

[Smashley]

I suspect this user may have a field extracted as 'AEMError' that they have not shared, so only they would get the extracted field results. If they share this then others should be able to benefit (perhaps they can't for lack of permissions?). Alternately one could add  regex to the query above to extract the field before piping to the top command. Running the query in Smart Mode (without the top command) should show AEMError field under the 'interesting fields' section for only that user presumably?

[scelikok]

Hi @harryc42,

Is it possible that another user has no permission on the index that has ERROR in particular hosts? Does he/she see events? 

[harryc42]

The search returns hits for anyone, just the formatting of the "stats" tab does not work for anyone except the original author.

What is the AEMError  (the very last argument) called ?  Is that a format or an additional table ?