Hi
I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully.
FYI:
1-give read permission to all users.
2-report run as report owner.
3-give permission to users to access index.
4-give permission to users to access data model.
5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL
6-As you see i have 2 search, when user delete whatever exist in second search users able to see events.
Any idea?
Can you ask the users to try to search the data from the Index, just by writing index=index_name and see what results do they get.
I've seen the issue, where due to multiple roles assigned to the users, sometimes the permissions don't work correctly.
1-when user just search index result show successfully.
2-only one role assign to user.
Any other idea?
Have you checked Search job inspector ?
Yes as I mentioned in 5