All Apps and Add-ons

F5 Security: Within the "All Indexed data" section, how do I remove the option have it follow the role permissions?

joeld
New Member

I have the Splunk App installed "F5 Security" which has a section on the home-screen labeled "All indexed data". Within this section it is listed All: Sources, Sourcetypes and Hosts. My user Roll is restricted to index and policy and inherits permissions for the user.

Is there a way to restrict data based on the Role of the user or just stop list the data all together?
Is there a way to just remove this whole "All Indexed data" section?

Thank You.
alt text

0 Karma

rewritex
Contributor

Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information.

    <view template="dashboard.html" onunloadCancelJobs="True">
      <label>Indexed Data</label>
      <module name="AccountBar" layoutPanel="navigationHeader"/>
      <module name="AppBar" layoutPanel="navigationHeader"/>
      <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
      </module>
      <module name="TitleBar" layoutPanel="navigationHeader">
        <param name="showActionsMenu">True</param>
      </module>  

      <module name="SearchBar" layoutPanel="mainSearchControls">
        <param name="useAssistant">true</param>
        <param name="useTypeahead">true</param>
        <module name="TimeRangePicker">
          <param name="selected">Last 24 hours</param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>


>       **<module name="StaticContentSample"
> layoutPanel="panel_row2_col1"
> group="All indexed data"
> autoRun="True">
>         <param name="text">This lists all of the data you have loaded into
> your default indexes over all
> time.</param>
>         <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1">
>           <param name="label">Sources</param>
>           <module name="HiddenSearch">
>             <param name="search">| metadata type=sources | sort
> -totalCount</param>
>             <module name="Paginator">
>               <param name="count">20</param>
>               <param name="entityName">results</param>
>               <param name="maxPages">10</param>
>               <module name="LinkList">
>                 <param name="initialSortDir">desc</param>
>                 <param name="labelFieldSearch">*</param>
>                 <param name="valueField">totalCount</param>
>                 <param name="labelField">source</param>
>                 <param name="labelFieldTarget">flashtimeline</param>
>                 <param name="initialSort">totalCount</param>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2">
>             <param name="label">Sourcetypes</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=sourcetypes | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">sourcetype</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3">
>             <param name="label">Hosts</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=hosts | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">host</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module> 
>         </module>
>       </module>**

    </view>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...