topic Re: Search-App Activity-DropDown-System-Activity only viewable by Administrator in Splunk Search

Search-App Activity-DropDown-System-Activity only viewable by Administrator

t9445 — Fri, 24 Jan 2014 16:01:54 GMT

Hi, this is likely a noon question

In V6, "Search & Reporting" App - the menu-bar contains an "Activity" drop-down (far right next to "help"), if we are logged in as Administrator then within the "Activity" drop-down is "System Activity", otherwise it just contains "Jobs" and "Triggered Alerts"

The ability to access the Sub-Menu "Activity" (which contains essentially a great subset of the deployment-monitor/SOS apps) is only visible for the Admin user, what role-permission(s) or tweaks do we need to set on other roles (without inheriting admin directly) should we set to make that sub-menu visible please?

Re: Search-App Activity-DropDown-System-Activity only viewable by Administrator

martin_mueller — Sat, 25 Jan 2014 00:35:04 GMT

The "System Activity" link points to the status_index view in the search app, which by default is only visible for the admin role. You can of course change that and add other roles - make sure to make all linked pages visible as well though. Additionally, those views are going to look inside the _internal index, so that role must be able to search that as well.

Re: Search-App Activity-DropDown-System-Activity only viewable by Administrator

t9445 — Mon, 28 Sep 2020 15:43:54 GMT

Hi, this does not appear to work?

The user-group does have access to _internal (e.g. can run "index=_internal" queries etc) – and the user in question is a member of “other_group” (see below please).
Have setup permissions to allow the user-group to have full r/w access to [views/status_index], even restarted the search-head – the user group in question cannot see the dropdown-menu still?

e.g. in /etc/apps/search/metadata/local.meta

[views/status_index]
access = read : [ admin, other_group ], write : [ admin, other_group ]

Appreciate any further advice.

Thanks

Re: Search-App Activity-DropDown-System-Activity only viewable by Administrator

martin_mueller — Mon, 27 Jan 2014 21:56:42 GMT

Concerning #1 - as I've said in the answer, that role must be able to search the _internal index. If your role cannot do that then you need to allow that role to search it, or give the users a second role that does nothing other than allow them to search _internal.

Concerning #2 - yeah, the menu will not magically appear. However, you can drop a link to the status_index view in the regular navigation for your apps. They'll be able to use the view despite not being able to see the dropdown menu.