Dashboards & Visualizations

How to display a different error message than "No results Found" when user is not entitled for result index?

anandhim
Path Finder

Sometimes users who get access via general role do not have access to indexes for all applications in our deployment. When such a user tries to search on an index he/she does not have access to, they get "No Results Found" which is mis-leading as the real reason is that they are not entitled to any of the search results. This is more of a problem for senior managers who start to think we do not have the data indexed.

Is it possible to change the message thats returned in such a scenario instead of default "No results found"?

Tags (1)
0 Karma

somesoni2
Revered Legend

I don't think so its possible. When you're writing a search, you just write filter clause, which will be searched upon the indexed data to which you have access to. So like if you don't have access to indexA and execute search "index=indexA", then Splunk searches from all the indexes your have access to for filter term "index=indexA" which obviously matches nothing and "No Results Found" is shown.

0 Karma

Lazarix
Communicator

The function you need to use for this is | appendpipe
This allows you to

| eval columnname = "You're not allowed" | eval somecolumn = 0 | where count==0

0 Karma

Lazarix
Communicator

Anandhim, does this solve your problem?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...