Splunk Search
Highlighted

Why is a power user unable to search a particular index?

Communicator

I have admin user and power user (role=power), when i search a particular index (iisweb) it does not return the output for power user but gives output for admin user. But for other indexes it returns the output. The server for iisweb is 2012 and others are 2008 . Is it related to OS or some other reason?

Tags (4)
0 Karma
Highlighted

Re: Why is a power user unable to search a particular index?

Motivator

Edit the power role and see if that index is searchable for users in that role. If it's not listed under "restrict this role to xyz index(s)", adding that particular index would allow searching.

Hope this helps!
Thanks,
Raghav

Highlighted

Re: Why is a power user unable to search a particular index?

Communicator

Thanks for reply..but its not working.. "main" is already added

0 Karma