We have a dashboard that monitors cost and fees for over 30 in-house applications. We need to have each application owner be only able to view their application and no other application owner's app.
AND (APPLICATIONNAME=$tok_payApp$ ....
$tok_pay$ is a selectable token from a dropdown input.
What we are looking for...
When user A. Smith clicks the dropdown they should only be able to see costingApp.
When user B. Jones clicks the dropdown they should only be able to see accountsApp.
Is it feasible to create a conf file with a list of users and corresponding $tok_pay$ values, and assigning it for a particular dashboard? Maybe built into the dashboard's XML code; or via a JS or CSS file; or another mechanism?
We don't want the administrative burden of building and managing 30+ dashboards in order to fulfill this requirement to our application owners; and we don't want to create separate indexes, etc., to handle this either.
Any fezzes or other experts come across this requirement before?
Run this macro against the _audit index with a one minute time range. The results will be the list of their apps will be seen in the drop down.
| eval payUser = user
| lookup payUserToApp.csv payUser OUTPUTNEW payApp
| dedup payApp
| table payApp
| mvexpand payApp
Now what I found interesting is that if I did not use the | mvexpand payApp at the end of the search my results would be concatenated.
Ex.: Without | mvexpand payApp MVVEHPPLSMyLicense
With | mvexpand payApp MVVEHPP
Is it the macro, the lookup table, or combination of the two that causes this behavior?
When I run a similar search, there is no need to run the | mvexpand payAppcommand.
| dedup host
| table host
Thanks and God bless,
PS Unless someone has a better solution, I will make this as Accepted at the end of the week.