How can I hide the Splunk DB Connect app from users but give access to commands, connections, lookups etc.?

[AlexeyNL]

Hello.

I've got some apps that uses dbxlookup command. I dont need users of the apps to see Splunk DB Connect in the list of available apps. On the other hand i can't make DB Connect invisible because I use it for administrative purposes.
If I grant access to users of the custom apps to db_connect_user role and delete read access db_connect_user from DB Connect access list the user of the custom apps got error in the reports:

Search Factory: Unknown search command 'dbxlookup'.

Is it possible hide DbConnect from users of certain apps and stay reports working?

[andrea_o]

Since there's no official solution, I share a sub-optimal solution I've come up with.
It applies only to lookups, and is assuming your lookup table doesn't change very often.

As an administrative user, you schedule a search in the form of
|dbxquery ##### | outputcsv lookupname.csv

Then in the filesystem of the search head, you establish a symbolic link between the spooled output file and the dir where lookups tables reside (for security reasons, outputcsv cannot write directly a lookup table, AFAIK)

After doing this, you declare a standard csv lookup pointing to the symlink, and non-privileged users can use the standard
| lookup lookupname.csv
syntax

[andrea_o]

ME TOO.

DB connect v1 was poor, but v2 implementation is even worse.

[lfedak_splunk]

Hi @AlexeyNL, did you figure out a solution for this?

[harsmarvania57]

Hi @AlexeyNL,

As far as I know when you remove read access of any app, artifacts (like searches, dashboards, macros & commands) will not visible to another role's user. So you can't achieve solution for your problem.

Thanks,
Harshil