Splunk Search

Field extraction invisible to other users despite global permission

AWED
Engager

With splunk 4.1.6 : a user has defined a custom field extraction in the "search" app. As as admin, I have changed the permissions on that to be "all apps" with "Everyone" having read permission.

Despite that, when searching within the search app., that field is still only showing as being extracted for the user who created it, not for anyone else.

I then moved the field extraction to a custom app, but still cannot access it even when running searches within that app.

Any suggestions?

chimell
Motivator

Hi AWED
Go verify the capabilities of the user role .Because it can limit the action of user.
you could go to Settings > Access control > Role and you will see Selected capabilities. For example Admin_all_objects capability mean that the user who has this role can manage all the objects.

Tell me if it work like you want

0 Karma

hulahoop
Splunk Employee
Splunk Employee

Is the field extraction an inline extraction (e.g. EXTRACT-foo = ...)?

0 Karma

vbumgarn
Path Finder

Those settings are actually stored in a file called local.meta, at $SPLUNK_HOME/etc/apps//metadata/local.meta

You should an entry like this:

[props/OSS_TL1/EXTRACT-sessionOpenClose]
access = read : [ * ]
export = system
owner = userName

I believe the important bits are the "export = system" and "access = read : [ * ]"

Does your local.meta look similar to that?

AWED
Engager

Yes, the file is there and it does look like that.

So what do we do now? There is clearly some other issue.

0 Karma

fabiocaldas
Contributor

AWED, did you got any solution? I'm facing same problem to a role group

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...