We created new roles and assigned capabilities, but why are users sometimes unable to view dashboards?

[splunker9999]

Hi,

We are seeing a weird issue with our roles.

We have created new roles and assigned capabilities for our new APP. Although all the roles and capabilities look good, users with that role are unable to view dashboards periodically (some times they are able to view)..But if we log in with admin access, we are able to view all the dashboards.

Whenever a user is facing this issue, we are just refreshing the search head using /deploy/reload and then are able view dashboards.

Note that Our Search heads are in POOL, and apps are located in the below location: This was my first time working with pool environment

cd /mnt/splunk_coe/coe_pool/etc/apps/myapp/local/authorize.conf

We also have cd /opt/splunk/etc/system/local/authorize.conf

Is this some file precedence happening?

Thanks
Sarath

[acharlieh]

There is indeed a precedence of merging the values between the multiple authorize.conf files, as is described in the docs here

Given a generic x.conf file that looks like this:

[stanza]
key = value

If a particular stanza + key pair is defined in both locations the value in etc/system/local will take precedence because authorize.conf is a global configuration file. If you are having issues with capabilities then this might be the issue.

But the behavior you describe, I wonder if you're running into something with just normal knowledge object permissions not being set correctly for your roles. You should be able to see the permissions in the Splunk UI, but on disk they would be defined in either /mnt/splunk_coe/coe_pool/etc/apps/myapp/metadata/local.meta and/or /mnt/splunk_coe/coe_pool/etc/apps/myapp/metadata/default.meta. The admin account has the capability to admin_all_objects which allows the user to ignore all permissions and see everything (hence why this might be an option).

Another potential option is if your dashboards are private to a particular user... last I played with it, in this case the admin would be able to see the existence of such a dashboard but wouldn't be able to actually use the dashboard so this might not be your issue.