How to remove search button below the panel and se...

varad_joshi · ‎08-17-2020

I have couple of related things to be addressed.

I want to remove the search button from the panels so that users from specific roles can only see the dashboards.

While the 'user' cannot see the search button, I want admins to see that option.

So putting <option name="link.openSearch.visible">false</option> in the XML is ruled out.

Is there any other way?

I do not want users to have the search capabilities as well. If I am doing that, the searches in dashboards are also not working. Can I make them see the dashboards but take away the capabilities of running the ad-hoc searches?

niketn · ‎08-30-2020

@varad_joshi you can refer to one of my older answers to use logged in user role in Splunk Dashboard and enable/disable required inputs for non-admins:https://community.splunk.com/t5/Security/Can-i-restrict-permissions-for-the-text-box-drilldown-input.... In your case you would need to hide the Open in Search link.

  <init>
    <set token="searchShowHideCSS">visibility: hidden !important;</set>
  </init>
  <search>
    <progress>
      <!-- No Results Found - Hence admin role is attached with logged in user enable Open in Search Link-->
      <condition match="$job.resultCount$==0">
        <set token="searchShowHideCSS"></set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <set token="searchShowHideCSS">visibility: hidden !important;</set>
      </condition>
    </progress>
    <query>| rest splunk_server=local /services/authentication/current-context 
| fields username roles 
| eval roles=mvjoin(roles,",") 
| search roles!="admin"</query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
        <style>
          a[data-original-title="Open in Search"]{
            $searchShowHideCSS$
          }
        </style>
      </html>
    </panel>
  </row>

For the second question you may have to provide more details. If you can provide users with results from a predefined Report or Scheduled search you can use the loadjob command, hence abstracting the underlying search. Users can have access to the report but not to search.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dionrivera · ‎09-29-2023

Any suggestions how to do this in Studio using json? Thank you.

richgalloway · ‎09-29-2023

This thread is over three years old, is not related to Dashboard Studio, and involves a user who is no longer on the forum. Please post a new question.

---
If this reply helps you, Karma would be appreciated.

How to remove search button below the panel and search capabilities as well

panel

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?