Dashboards & Visualizations

How can a restricted user to view a custom app's dashboard, which contains a lookup definition from an app that the user does not have access to?

adamsmith47
Communicator

My question is very similar to this one: https://answers.splunk.com/answers/227852/is-it-possible-to-use-a-lookup-table-defined-in-on.html
which has been answered, but mine is subtly different.

In my scenario, I have a restricted_role, which, off all the apps, only has access to a custom_app (I do not want the restricted_role to have access to the Search and Reporting app). In the Search and Reporting app, there is a lookup_table and lookup_definition, both of which have permissions set to Global (all apps), Everyone can Read. However, the dashboard panels in my custom_app which reference the lookup_definition fail to run, with:

"Error in 'lookup' command. The lookup table 'lookup_definition' does not exist or is not available."

If I extend the permissions for the Search and Reporting app to include restricted_role, the panels run fine. However, I do not want this role to have access to the Search and Reporting app.

I'm looking for advice for how to resolve this. I know I could create a new lookup_file and lookup_definition in the custom_app, but, I'd prefer not to have duplicate knowledge objects to maintain. Any advice is welcome. Thank you.

0 Karma

snoobzilla
Builder

Have you tried creating up a lookup definition in the target app against the global lookup table? Then at least it same underlying file and you won't have maintain 2 copies of the data.

I have had good luck on global lookups by creating them using the outputlookup command. If above doesn't work, try making a copy of table using outputlookup and point a lookup definition from each app at the new file.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...