https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169210#M48321 <P>Maybe should you encrypt events instead of trying to protect the search string ?<BR /> It seems you could use a search string with masked (under custom patterns) arguments <BR /> Look at:<BR /> <A href="http://blogs.splunk.com/2010/01/25/encrypting-and-decrypting-fields/">http://blogs.splunk.com/2010/01/25/encrypting-and-decrypting-fields/</A></P> <P>Note sure it's relevant for your case but maybe a way for you</P> Tue, 12 Aug 2014 08:00:15 GMT guilmxm 2014-08-12T08:00:15Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169200#M48311 <P>Hello,<BR /> when I open my dashboards the search string is embedded in the link. How can I hide the string, that nobody can change the search?</P> <P>Greetings</P> Mon, 04 Aug 2014 13:10:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169200#M48311 C_Sparn 2014-08-04T13:10:10Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169201#M48312 <P>Can you provide your dashboard xml?</P> Mon, 04 Aug 2014 13:39:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169201#M48312 somesoni2 2014-08-04T13:39:40Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169202#M48313 <P><INPUT type="dropdown" token="year" /><BR /> <INPUT type="dropdown" token="time" /><BR /> <INPUT type="radio" token="new_time" /></P> <P><SEARCHSTRING>index = ticket sourcetype =log $new_time$ TicketStatus = "closed"|join Ticket[|inputlookup average.csv|rename tickets as Ticket]|stats count(Tickets) as count <BR /> </SEARCHSTRING></P> <P>I found the reason why the search string is embedded in the link. It is embedded if an input like $new_time$ is part of the search string. Sorry but I had to delete the rest of the dashboard xml. But I need the inputs without having the search string in the link.<BR /> Greetings</P> Tue, 05 Aug 2014 06:24:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169202#M48313 C_Sparn 2014-08-05T06:24:36Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169203#M48314 <P>Hello is it possible to encrypt the link?</P> Wed, 06 Aug 2014 11:07:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169203#M48314 C_Sparn 2014-08-06T11:07:41Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169204#M48315 <P>In simple xml, you could do this:</P> <P>You can hide the tool bar using css to prevent users from accessing to the search.</P> <P>.dashboard-row2 .paxnel-footer {<BR /> display: none;<BR /> }</P> <P>Then deactivate any drilldown in your view</P> Wed, 06 Aug 2014 12:00:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169204#M48315 guilmxm 2014-08-06T12:00:57Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169205#M48316 <P>Sorry I do not know where I can set this css code in simple xml! Do you mean advanced xml?</P> Wed, 06 Aug 2014 12:42:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169205#M48316 C_Sparn 2014-08-06T12:42:20Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169206#M48317 <P>No, in simple xml.</P> <P>Create a css file you put in $SPLUNK_HOME/etc/apps/<YOURAPP>/appserver/static</YOURAPP></P> <P>Put your css code, and restart at least Splunk Web (./splunk restart splunkweb)</P> <P>Then in your view, edit the xml code (using the integrated editor) and add the stylesheet after the form or dashboard pattern:</P> <P><DASHBOARD stylesheet="myfile.css,myfile2.css"></DASHBOARD></P> <P>Refresh the page, sometimes it's may be a good idea to clean your browser cache.</P> Wed, 06 Aug 2014 12:50:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169206#M48317 guilmxm 2014-08-06T12:50:49Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169207#M48318 <P>That was a good idea guilmxm but I need a server side manipulation or encryption of the link. Are there any suggestions?</P> Mon, 11 Aug 2014 11:05:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169207#M48318 C_Sparn 2014-08-11T11:05:11Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169208#M48319 <P>Hi, You could use a macro which contains your search string, and the use it in your view.</P> <P>You'll have to deal with arguments, but it will do the trick.</P> <P>For example, the search:</P> <P>index=_internal | stats count by host</P> <P>Would be masked under the macro "foo", and you would call it with:</P> <P><CODE>foo</CODE></P> Mon, 11 Aug 2014 16:46:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169208#M48319 guilmxm 2014-08-11T16:46:19Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169209#M48320 <P>The problem is that the arguments are the security vulnerability. So if the arguments can be changed also the search macro is senseless. But thank you for the suggestion.</P> Tue, 12 Aug 2014 07:09:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169209#M48320 C_Sparn 2014-08-12T07:09:11Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169210#M48321 <P>Maybe should you encrypt events instead of trying to protect the search string ?<BR /> It seems you could use a search string with masked (under custom patterns) arguments <BR /> Look at:<BR /> <A href="http://blogs.splunk.com/2010/01/25/encrypting-and-decrypting-fields/">http://blogs.splunk.com/2010/01/25/encrypting-and-decrypting-fields/</A></P> <P>Note sure it's relevant for your case but maybe a way for you</P> Tue, 12 Aug 2014 08:00:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169210#M48321 guilmxm 2014-08-12T08:00:15Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169211#M48322 <P>No sorry but does not help in my case.</P> Thu, 14 Aug 2014 06:37:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169211#M48322 C_Sparn 2014-08-14T06:37:46Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169212#M48323 <P>Sorry, out of idea <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 14 Aug 2014 09:01:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-search-string-in-the-link-for-my-dashboards/m-p/169212#M48323 guilmxm 2014-08-14T09:01:56Z