Splunk Search

report not load search command result for users

indeed_2000
Motivator

Hi
I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully.

FYI:
1-give read permission to all users.
2-report run as report owner.
3-give permission to users to access index.
4-give permission to users to access data model.
5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL
6-As you see i have 2 search, when user delete whatever exist in second search users able to see events.
Any idea?

alt text

0 Karma

shivanshu1593
Builder

Can you ask the users to try to search the data from the Index, just by writing index=index_name and see what results do they get.

I've seen the issue, where due to multiple roles assigned to the users, sometimes the permissions don't work correctly.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

indeed_2000
Motivator

1-when user just search index result show successfully.
2-only one role assign to user.

Any other idea?

0 Karma

to4kawa
Ultra Champion

Have you checked Search job inspector ?

0 Karma

indeed_2000
Motivator

Yes as I mentioned in 5

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...