Dashboard visibility issue

[bworrellZP]

So I had a dashboard that was in testing, so it was private. Since I have completed it, I changed it, made visible in the app (search app), set to everyone for read.

Then I logged in as a test user. The dashboard is there, all panels are visible. Issue is that everything says "no results found", If I click the spyglass, nothing shows in the statistics, yet there are events in the events tabs.

User that I was testing with is also an admin.

Thoughts on what to check and where?

[ChrisChalmers01]

You mention that you changed the permissions for the dashboard but did also change the permissions for the reports / searches that power the dashboard?

[mayurr98]

hey
So for a test user you must have assigned some role. For that role, check if you have given capability to search desired indexes which make that dashboard run
Edit a role using https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/Addandeditroles#Add_or_edit_a_role
and assign Indexes searched by default and indexes a desired index on which the dashboard is built.

I hope that help!

[bworrellZP]

I believe I have found a bug. Test user is in a splunk group that comes from AD, (splunktier3sec), but also inherits some other roles. (User ends up with these roles - admin, power, splunktier3sec ) I had to add the searched indexes by default the indexes in use, to the admin role, even though they were in the splunkteir3sec role already. (Dashboard searches also had the indexes listed, so it should not have been needed anyway). Guess that role trumps all others.

Will test later with non-admin, with only one role. But at this point, I believe this to be the case.

[mayurr98]

Yes test later with non-admin
Also test by creating role Access controls » Roles and assign the desired capabilities and create a test user using Access controls » Users

[mayurr98]

Please accept/upvote my answer for future readers if you feel its correct!