Security

Same Query different user with matching permissions does not return results

james_j_taylor
Explorer

When I run the below query as an admin it returns results however when run as a user it does not. The user is a power user with admin rights, the time picker is set the same. There are no exclusions from the users rights to indexes ( as far as I can tell)

index="login_data" sourcetype="Login_Data"[search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID ] | eval SignonID=upper(SignonID) |  bucket _time span=1d | stats count as LoginCount by _time, SignonID | join type=outer SignonID [search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID EMP_NAME ] | timechart values(LoginCount) as LoginCount by EMP_NAME
0 Karma

james_j_taylor
Explorer

Field extractions were private. I thought since I added the admin role that the role would share the same objects. For this project I changed the objects to global.

0 Karma

BobM
Builder

It looks like the search should work providing the user has access to all the same knowledge objects and indexes.
Check try the following 2 searches.

index="login_data" sourcetype="Login_Data | stats count by SignonID

index="hrxref_data" sourcetype="HR_XREF" | stats values(LVL1_MOID) values(MOID)  values(SignonID) values(EMP_NAME)

If any of the searches or columns are empty, look to see if the user can see the index and that field extractions are not private.

james_j_taylor
Explorer

Thanks. You were correct. I made sure the indexes were viewable but the fields were private as well.

0 Karma

kristian_kolb
Ultra Champion

What does the job inspector say (little 'i' icon near the time picker)?

Could some field extraction take place in an app's props or transforms, and the user-role does not have access there?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...