Dashboards & Visualizations

How to display a different error message than "No results Found" when user is not entitled for result index?

anandhim
Path Finder

Sometimes users who get access via general role do not have access to indexes for all applications in our deployment. When such a user tries to search on an index he/she does not have access to, they get "No Results Found" which is mis-leading as the real reason is that they are not entitled to any of the search results. This is more of a problem for senior managers who start to think we do not have the data indexed.

Is it possible to change the message thats returned in such a scenario instead of default "No results found"?

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't think so its possible. When you're writing a search, you just write filter clause, which will be searched upon the indexed data to which you have access to. So like if you don't have access to indexA and execute search "index=indexA", then Splunk searches from all the indexes your have access to for filter term "index=indexA" which obviously matches nothing and "No Results Found" is shown.

0 Karma

Lazarix
Communicator

The function you need to use for this is | appendpipe
This allows you to

| eval columnname = "You're not allowed" | eval somecolumn = 0 | where count==0

0 Karma

Lazarix
Communicator

Anandhim, does this solve your problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...