Splunk Search

why user with same role not able to see data

vikramyadav
Contributor

Hi Guys,

I have created a simple query with stats command and I'm able to see the required results.

If same search is ran by another user he is not able to see results but if that user removes commands from the search query he is able to see events.

I checked permission of that user and it have same roles which I have.

So I beleive it's not a permission issue.

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Can it be hat this error_id field is your own field extraction not shared within app or global level?

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Hi
can you post the query, description of environment (single node, shared environment etc.)?
r. Ismo
0 Karma

vikramyadav
Contributor

Hi @isoutamo,

It's a single node. Below is the search query which I'm using.

index=abc host=xyz "Error executed unexpected" | stats count(error_id) as error

If user is running whole seach query he is not able to see results where as if user is not using command he is able to see events.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can it be hat this error_id field is your own field extraction not shared within app or global level?

vikramyadav
Contributor

thanks, @isoutamo  that worked.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...