Custom search app ?

[stwong]

Hi all,

We're using Splunk 7.0. Recently we're being ordered by boss to open up Splunk web interface for a customer to do searching.
I created role for the user to restrict search terms and indexes, and create app cloned from search app by removing some menu items like Datamodel, Alerts. As we've lot of apps/add-on installed, it's tedious to update permission for all one by one. However, unable to hide the App navigation drop down menu. How can we do that? Or will it be any better way to create accounts/roles/apps in a multi-tenant environment?

Thanks a lot.
Regards
/ST wong

[niketn · Accepted solution]

@stwong, refer to my older answer to restrict Dashboard Access based on logged in User Role: https://answers.splunk.com/answers/588779/whats-the-best-way-to-limit-a-role-so-it-only-has.html

You can create your own Search UI using Splunk JS as a dashboard and then within all your dashboard if the drilldown needs search you can code them to launch your Search UI Dashboard instead of Splunk Search. This way restrictions as per above thread can also be applied to search view: https://answers.splunk.com/answers/586948/how-to-change-app-banner-css-when-open-search-in-s.html

Also refer to the following older answer of mine for Hiding Splunk App Bar(similar approach as covered in first answer link above): https://answers.splunk.com/answers/636485/how-can-i-use-a-token-to-set-hidesplunkbar.html

[InderSingh1]

Hi,

Is there any way I can create more than one search bar in the same dashboard?

[stwong]

Thanks for the suggestions, that match with what we need. Will give them a try.

Thanks a lot.

[CarsonZa]

I dont believe you can, i was in a similar situation and just had change permissions one by one. which realistically does take to long just tedious. Keep in mind not all apps in the drop down are visible in the first place by default so that should shrink your list a bit.

you could change
[ui]
is_visible = 0

in app.conf but this will hide the app from all users but still allow access to all the KO and app if you know the path.

[stwong]

Hi thanks. We also use this method for Splunk instance with few apps installed, but looking for ways to hide apps menu on per user/role basis. Fyi.

Thanks.