All Apps and Add-ons

Segregate notable in Single ES deployment

Nawab
Communicator

Let suppose, we want to create a dashboard on notable index, which is shared with all team, but we want to create a dashboard for every team to see notables related to them.

 

But we want to restrict them to only see this specific search and they can not even change the search when they click the search icon on the dashboard.

 

is it possible?

 

or how can we segregate notable in a single ES deployment?

Labels (1)
0 Karma

Nawab
Communicator

can you let me know how

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab,

in the panl's optins add 

<option name="link.openSearch.visible">false</option>

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab,

ES isn't multitenant and you are asking how to use ES in multitenancy!

you have to create a custom dashbord that accesses the Notable index,

The real problem is how to profilate the users, you could use e.g. sourcetype or another field in the Notable index.

You should customize all the Correlation searches to write a field in the Notable index to identify notables for each users.

Ciao.

Giuseppe

0 Karma

Nawab
Communicator

I can do that, but a use case modify the search and see all notables not related to him. how can i stop user to modify search

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab,

you can disable the edit button and don't give grants to modify the view to the role used by these users.

Ciao.

Giuseppe

0 Karma

Nawab
Communicator

yeah, still he can click on search icon and modify the search in search app

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab,

disable the Open in Search feature.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...