Dashboards & Visualizations

How to Restrict Splunk User Access to only one dashboard in search & reporting?

katzr
Path Finder

I know that you if you want a user to only view one dashboard- you can create another app and assign that user's role to that app. Is there any way to restrict a user to view only one dashboard in the generic search & reporting app that multiple users have access to?

I know that you can restrict a user to only search on one index- does that in turn restrict a user to only view dashboards that contain that index? For example: user A can only search on index=example, so if that user tries to view a dashboard that pulls from index=example2- can user A see this dashboard?

Thank you in advance for the help!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi, katzr,
it's not a good idea to use Search and Reporting App, it's better to create Apps for the users.

Anyway, to give access to a dashboard only to one user you could:

  • create a new role,
  • assign that role to the user
  • give grants on that dashboard only to that role; in this way only the new role and Admin can access the dashboard .

It's different for Indexes, because if you have a dedicated index for your dashboard, you can share it only with the new role, but at the same time, you have to disable access to this index to all the other roles.

Bye.
Giuseppe

0 Karma

Jon_Webster
Splunk Employee
Splunk Employee

Is there any way to restrict a user to view only one dashboard in the generic search & reporting app that multiple users have access to?
No. The way this is usually addressed is to create an App with the desired set of dashboards for a Role, and if generic search is required then that page is included in the App.

Can a user be restricted to view dashboards that contain specific indices?
No. Indices are not coupled with Apps. Similar to the first example, this is usually addressed by creating Apps for the Role that include indices appropriate to the Role, even if it may mean creating multiple similar Apps by Role.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...