Dashboards & Visualizations

Why are field values in a dashboard not visible to users?

srisplunk12
Engager

Hi All,
We have this issue in our environment where in one of the dashboards, field values of the extracted fields (numbers) are not visible to the users.

But the same value appears in the dashboard when i login as an admin.

I verified the permission of the role which seems to be fine and i have also increased value of the concurrent search for the user role but no luck..

any thoughts..

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The data is not corresponding to the extracted fields, but field extraction are associated with the data. E.g I can have a field with name "src_ip" which may be available in different type of data. In Splunk, if this field is extracted explicitly, it'll be extracted for a specific type of data, may be for a sourcetype, source or a host. So, what you need to check here is whether the extracted field associated with your current sourcetype/source/host allows that user to read (Settings->Fields -> Field extractions and find your field extraction pertaining to sourcetype/source/host and check the sharing permission).

srisplunk12
Engager

Setting the permissions for the fields from field extraction did the trick..thanks a lot !

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Awesome. Please accept the helpful answer, then.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Is the sharing permission on the field extraction that has been setup (assuming) allows that user's role to read?

0 Karma

srisplunk12
Engager

data from the same extracted fields is been read by the user role in a different dashboard....also am not sure how to check the sharing option on the extracted field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...