dashboard dropdown list by index

[sarit_s]

hello
i have a dashboard with dropdown list which the search behind is :

index="emea_fdm" OR index="amer_fdm" |rex field=source \/splunk\/(?\w+) |dedup Region |table Region

i have security regulation that requires me to set rule to each user that he will be able to see data from specific index only. so for example, my user has role to see only emea_fdm index and data and not amer_fdm data.

im trying to set this dropdown list so each user will be able to see only the index relevant to him (i don't want to duplicate dashboards for each region)

the search has i pasted here gives me no results when im logging in with user who has rule to see index emea only

someone has any idea how can i achieve my goal ?

thanks

[niketn]

@sarit_s even if you have multiple indexes mentioned in your Splunk query, user will be able to pull data only from the index that they have access to. So, your query should still work. However, from performance standpoint, since your query is based on index and source metadata fields you can use tstats instead.

| tstats count where index="*_fdm" by source
| rex field=source "\/splunk\/(?<Region>\w+)" 
| dedup Region 
| table Region

Or if the index names do not have pattern

| tstats count where index IN ("emea_fdm","amer_fdm") by source
| rex field=source "\/splunk\/(?<Region>\w+)" 
| dedup Region 
| table Region

PS: While posting code on Splunk Answers please use the code button one with 101010 icon or shortcut Ctrl+K, so that special characters do not escape.

[sarit_s]

this query does not return any results

i know that the query should still work but it isnt 🙂

[sarit_s]

this is what im getting :

"Could not create search."