Variables/constants for roles

[splunked38]

Hi All,

Is there any way to assign a 'variable' to a role?

We're creating a dashboard for many sites (15+) which will show their local information.

The idea is that they would log in and get their local dashboard based on role.

Notes:

• The dashboard is written in Advanced XML with macros to centralise the queries.
• We're avoiding using variables in the URL to avoid the site looking up other sites' details.
• We'd like to package it up as an app to allow for change control, deployment, etc (we can decentralise the queries quite easily)

Thanks in advance.

[somesoni2]

If you're looking for getting current logged in user's role and having that in a variable inside the dashboard, you can use following query (works for user role as well) to get the same and can use ResultValueSetter module to have that stored into a variable in dashboard.

| rest /services/authentication/users splunk_server=local | search [| rest /services/authentication/current-context | rename username as title | fields title] | table title, roles

And this can be used in dashboard like this:

<module name="Search">
            <param name="search">
                <![CDATA[
    | rest /services/authentication/users splunk_server=local 
    | search [| rest /services/authentication/current-context 
    | rename username as title | fields title] | table title, roles
                    ]]>

            </param>
            <module name="ResultsValueSetter">
                <param name="fields">title, roles</param>
                ....
                ....

[splunked38]

Thanks for the response.

I just thought about this again and have a few caveats which I'll probably post as separate questions.

Ideally, we're trying to avoid using Sideview utils for the time being (I suspect this cannot be avoided, don't have anything against Sideview utils, just wondering if it's possible).

Your search solution works fine but the role needs to be set as a $variable$ which I can then use:
*as output eg: Dashboard 1 ($variable$)
*as part of another search/macro eg: macro(site=$variable$)