Dashboards & Visualizations

Cached dashboards and permissions

HeinzWaescher
Motivator

Hi,

I've changed the permissions of a dashboard, to allow user A to have a look at it. The included reports are scheduled every night.

When user A opens the dashboard no cache is used and all reports start searching from scratch. Is there a way to avoid this? It's a bit uncomfortable to wait for the next schedule or rerun the cache manually, everytime I change read permissions for new users.

BR

Heinz

0 Karma

ecambra_splunk
Splunk Employee
Splunk Employee

Are the permissions for the searches/reports powering the dashboard also allowing user A to view them? If the user does not have permissions to also view the report it may not allow access to the saved/scheduled search.

Additionally, What is the alert expiration for the scheduled search/report? This could be causing the report to expire before the next days report has run. You can also check the Activity > Jobs to insure the search is running and caching results.

0 Karma

HeinzWaescher
Motivator

Hey, thanks for your answer.
Yes, the user is allowed to view them. And everything works fine, when the cache is refreshed once again after setting the permissions for this user.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...