topic Re: Create new App for new Role in Security

Create new App for new Role

hbazan — Fri, 02 Jul 2010 22:41:27 GMT

Hi there. I need to create a new App, and make it available to new users. Those new users should be able to access only this new App.

So I created a new role, cloned from User, and granted access to the new app and some of my views and saved searches. I've also allowed access to flashtimeline and my eventtypes.

In this new app I have a dashboard with links to my saved searches. The dashboard works fine, but with the links to saved searches, the new users get a 404 error: "404 Not Found

The following requested saved search is unknown: "My Search". As a result, Splunk is unable to redirect to a view."

Also, if I want to access directly to flashtimeline (http://splunk.../app/NewApp/flashtimeline), I get: "404 Not Found

Splunk cannot find the "flashtimeline" view."

What am I doing wrong?

Re: Create new App for new Role

erydberg — Fri, 02 Jul 2010 22:53:48 GMT

Have you checked in the manager that the searches are not owned by the admin, but by the app? That could cause these error messages. Go to Manager > Searches and reports and check that the owner is the app and not another user.

Edit: What I meant was to check that admin wasn't the owner of the saved searches and that that overrides the app permissions. I'm sorry about the confusion, apps can't own searches.

Re: Create new App for new Role

Lowell — Fri, 02 Jul 2010 23:07:35 GMT

What do you mean my owned by the app? Do you mean application-level sharing, or given read access to the role associated with the app? As far as I know, there is no concept of an "app" owning anything? (Obviously searches and other objects have to live somewhere, but be defined in an app is not the same as being the "owner" of the apps objects)

Re: Create new App for new Role

hbazan — Fri, 02 Jul 2010 23:08:21 GMT

No, that's OK.
The thing is (i forgot to mention on my post) if I grant the new user the "User" role, everything works fine.
It's like in some point there's a lack of a permission. Maybe some command?

Re: Create new App for new Role

Lowell — Fri, 02 Jul 2010 23:08:40 GMT

What version of splunk are you running? Are you sure that "flashtimeline" is accessible to your new role? (It should be by default). Have you setup any navigation for your new app?

Re: Create new App for new Role

erydberg — Sat, 03 Jul 2010 00:50:04 GMT

Did you check the permissions link in the manager > searches and reports? There you can set with roles are able to read the saved search.

Re: Create new App for new Role

hbazan — Sat, 03 Jul 2010 01:38:38 GMT

I'm running Splunk 4.1.3. We've recently upadated from 4.0.6. My navigation is default, local to my app (readable for everyone). The dashboard is also defined in my app and readable for everyone. The flashtimeline is defined as Global, readable for everyone. I'm trying with one specific search, that is readable for User, Power, and MyNewRole.

Re: Create new App for new Role

hbazan — Sat, 03 Jul 2010 02:24:06 GMT

Yes, the roles are ok. I suspect that it's not the search the problem, but some view or command (I think so because a search is opened in the flashtimeline).

Re: Create new App for new Role

Zambonilli — Tue, 04 Jan 2011 06:34:23 GMT

This happens if the user doesn't have Read access to the Search application. I've started from a fresh install of the beta 4 version of and if you create a user in the Power user role and remove read permissions from the Search app for the Power role you will get this message.

Re: Create new App for new Role

Ant1D — Thu, 27 Jan 2011 00:29:57 GMT

How do you set a new role to have read access to the Search app

Re: Create new App for new Role

Zambonilli — Tue, 01 Feb 2011 02:21:14 GMT

We just added everyone to have read access to the Search app and then hid the Search app.