Dashboards & Visualizations

Dashboard permissions

L_Petch
Path Finder

Hello,

 

I have a dashboard that checks all indexes and displays the event count for today and the last write time. This allows users of the dashboard to alert if an index has not been written to in a certain amount of time.

 

My issue is that the dashboard runs when the user clicks into it and runs the searches using their permissions as expected. However they do not have access to all indexes so cannot see the stats for all indexes. What is the easiest way to change this so that they can see an event count for all indexes without having to give them access to the index?

 

 

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You can define the underlying search as a report and use it to power the dashboard panel. Then set the report to be run as owner instead of the calling user.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @L_Petch ,

schedule an alert that writes the indexes status in a lookup or in a summary index.

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's another way to tackle this problem. The difference is that my solution is (or at least can be) synchronous - the search gets run when your user opens the dashboard while @gcusello 's one needs to be run on schedule and you're displaying their result asynchronously.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @L_Petch ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can define the underlying search as a report and use it to power the dashboard panel. Then set the report to be run as owner instead of the calling user.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...