lguinn,
Your logic is the same as mine, right when I saw this answer I was playing with the field extraction permissions. I guess a previous user who was the main administrator of Splunk did not set permissions correctly, so that when left, the permissions left with him.
Thanks for all of your help!
... View more