Splunk Search

report not load search command result for users

indeed_2000
Motivator

Hi
I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully.

FYI:
1-give read permission to all users.
2-report run as report owner.
3-give permission to users to access index.
4-give permission to users to access data model.
5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL
6-As you see i have 2 search, when user delete whatever exist in second search users able to see events.
Any idea?

alt text

0 Karma

shivanshu1593
Builder

Can you ask the users to try to search the data from the Index, just by writing index=index_name and see what results do they get.

I've seen the issue, where due to multiple roles assigned to the users, sometimes the permissions don't work correctly.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

indeed_2000
Motivator

1-when user just search index result show successfully.
2-only one role assign to user.

Any other idea?

0 Karma

to4kawa
Ultra Champion

Have you checked Search job inspector ?

0 Karma

indeed_2000
Motivator

Yes as I mentioned in 5

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...