- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why do two different users using same Sh, same...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why 2 different users using same Searchhead, same app and same query and same permissions get 2 different results?
Could you please write in points the things I should troubleshoot.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I cloned the user that was not able to search the complete data, gave him different username and name, and now he started fetching all the data.
THis is quiet strange by Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I cloned the user that was not able to search the complete data, gave him different username and name, and now he started fetching all the data.
THis is quiet strange by Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @muizash,
try to use a past time frame (e.g. yesterday or last hour), in other words not latest=now and see if you continue to have different results.
Probably the difference is in the last ingested logs.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I checked and found out that the user with less event count, the query is not able to fetch one particular sourcetype. How to edit permissions? @gcusello
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @muizash,
sourcetypes haven't an owner or grants.
But they are in an App, so go in [Settings -- Sourcetypes] and see in what App is your sourcetype.
Then go in [Apps -- Manage Apps -- Permissions] and enable that App for the roles you need.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @gcusello
I found that app is "learned" for that particular sourcetype.
As i mentioned both users have same set of permission, if permission was the issue, why would other person be able to see the sourcetype results?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @muizash,
did you checked if the people that see the sourcetype has the same grants ot the ones with problems?
In addition, please check if in the search you're analyzing there are knowledge objects (fields, tags, eventtypes, etc...) with different grants for the two kind of users, maybe the problem is in one of these objects.
In particular see if there's one or more knowledge object used in searches or in dedup or in stats.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can search statements be published?
Also check if there is an error in "Search Job Inspector".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I checked and found out that the user with less event count, the query is not able to fetch one particular sourcetype. How to edit permissions? @HiroshiSatoh
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
