Knowledge Management

Created search with tags but does not work for other users

vincenty
Explorer

I have created several tags (on source), and use them in searches. The saved searches does not work for other users... is there a permission setting somewhere that I need to enable the saved search with tag for other users to use?

Tags (1)

emiller42
Motivator

My first guess is that the tags you created aren't exported outside of your scope. There are three levels of scope that knowledge objects can belong to:

  • User
  • Application
  • Global

Items created in the User scope are only visible to the user that created them. This allows person A to build their own knowledge without disrupting the work of user B.

Items in the Application scope are visible to all users when they are in the context of an application. (So items in the Search App scope only apply when the user is in the Search app)

Finally, items can have a Global scope which apply to everything.

Any tags you create in the UI will have a User scope by default. So you'll need to change that for others to see them. Go to "Manager > Tags" and then look for the tags you created. There will be a "Sharing" column which shows the current scope of the item. Clicking "Permissions" there will bring you to a new window where you can define the scope of the item. Change your tags to either "This app only" or "all apps" to make them visible to other users.

vincenty
Explorer

I saved this search and it worked locally:
tag="DC2-Central" | rex ".?(?(?:\w+.)+\w?Exception).*"

Other users see this saved search in their session & tried to execute this saved search but get the following error:
"Unable to find tag DC2-Central"

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...