Dashboard permissions

[L_Petch]

Hello,

I have a dashboard that checks all indexes and displays the event count for today and the last write time. This allows users of the dashboard to alert if an index has not been written to in a certain amount of time.

My issue is that the dashboard runs when the user clicks into it and runs the searches using their permissions as expected. However they do not have access to all indexes so cannot see the stats for all indexes. What is the easiest way to change this so that they can see an event count for all indexes without having to give them access to the index?

[gcusello]

Hi @L_Petch ,

schedule an alert that writes the indexes status in a lookup or in a summary index.

Ciao.

Giuseppe

[PickleRick]

That's another way to tackle this problem. The difference is that my solution is (or at least can be) synchronous - the search gets run when your user opens the dashboard while @gcusello 's one needs to be run on schedule and you're displaying their result asynchronously.

[gcusello]

Hi @L_Petch ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[PickleRick · Accepted solution]

You can define the underlying search as a report and use it to power the dashboard panel. Then set the report to be run as owner instead of the calling user.