topic working with metadata output. in Dashboards & Visualizations

working with metadata output.

sanju005ind — Tue, 18 May 2010 00:47:27 GMT

I have an environment where there are about 2000 hosts. All the hosts are tagged according to the geographic locations and the sourcetype(AD,DNS,DHCP). User are restricted to logs from hosts which belong to their country using roles. I would like each user to see on the default dashboard the hosts which they have access to the last reported date and the tag.

However it displays all the hosts. How can I facilitate the users to see only the hosts that belong to them on the dashboard?

Re: working with metadata output.

Simeon — Tue, 18 May 2010 07:19:32 GMT

sounds like this could be a bug. what is the restrict filter you are using?

Re: working with metadata output.

thall79 — Tue, 18 May 2010 19:44:23 GMT

The only way I have been able to filter the events while using | metadata type=host is to add a search host=srv* or use tags (tag=your_tag) to only search on that group of servers.

My next question would be if you are wanting to only create 1 dashboard for each team to use? If so this solution will not work and I am not sure if the is way to read the roles and insert that while using | metadata.

You could always clone the dashboard for each team and put in the filters associated with that team. Then give them the permissions to see that dashboard and not the other teams dashboard.

Travis.

Re: working with metadata output.

gkanapathy — Tue, 01 Jun 2010 21:02:33 GMT

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

Re: working with metadata output.

thall79 — Wed, 02 Jun 2010 03:25:56 GMT

Yes after looking at the post I did leave out important information, good catch there. Here is what I am using when filtering by tags: | metadata type=hosts | tags host | search NOT tag::host=remove | search host=*