topic Re: Limited Dashboard Access in Dashboards & Visualizations

Limited Dashboard Access

whitecat001 — Thu, 22 Feb 2024 16:52:47 GMT

Hello,

How do i provide access to a limited email address on a dashboard through the backend

Re: Limited Dashboard Access

richgalloway — Thu, 22 Feb 2024 17:33:11 GMT

What problem are you trying to solve?

Re: Limited Dashboard Access

whitecat001 — Thu, 22 Feb 2024 17:50:59 GMT

Am trying to provide limited access to a dashboard and am trying to do that through the backend

Re: Limited Dashboard Access

richgalloway — Thu, 22 Feb 2024 18:49:44 GMT

Splunk does not limit access by email address - it uses role-based access controls (RBAC). You would need to create a role and make that role the only one that can access the dashboard in question. Then create a Splunk account with the subject email address and assign that account to the new role.

Another option is to make the dashboard private to the user with the subject email address.

All of that is easiest to do using the GUI. How to do it "through the backend" depends on your environment (Splunk Cloud, standalone, SHC, etc.). It also depends on what you mean by "backend" - REST API, config files, or CLI commands.

Re: Limited Dashboard Access

whitecat001 — Thu, 22 Feb 2024 20:21:28 GMT

What i mean by backend is through the CLI

Re: Limited Dashboard Access

richgalloway — Sat, 24 Feb 2024 21:07:42 GMT

I'm not sure everything needed can be done from the CLI, but let's try.

Let's take the easier option of making the dashboard private to the user with the subject email address. I assume this is not a search head cluster.

1) Create the user.

splunk add user foo@bar.com -password changeme -role User

2) Locate the dashboard

find /opt/splunk/etc/apps -name <<dashboard>>.xml

This will return something like

/opt/splunk/etc/apps/<<app name>>/local/data/ui/views/mydashboard.xml

3) Create the user's private app directory.

mkdir -p /opt/splunk/etc/users/<<app name>>/local/data/ui/views

4) Move the dashboard to the private directory.

mv /opt/splunk/etc/apps/<<app name>>/local/data/ui/views/mydashboard.xml /opt/splunk/etc/user/<<app name>>/local/data/ui/views/mydashboard.xml

5) You may need to restart Splunk.

sudo systemctl splunk restart

Re: Limited Dashboard Access

whitecat001 — Sun, 25 Feb 2024 21:30:36 GMT

Thank you for your response. I will check it out