Re: if criteria matches a in my control file then ...

surekhasplunk · ‎01-12-2018

Hi,

My requirement is if i my login name appears in column name employee of my mapping.csv file which is my control file then i should load a particular dashboard.
And if my login name is listed under manager column in my control file then and different dashboard should populate.
How to do it in splunk dashboard.

Thanks

kamlesh_vaghela · ‎01-12-2018

Hi @surekhasplunk ,

I don't think so we can manage permission of particular dashboard using any lookup file or csv file. But you can achieve this. Can you please try below XML? I have used user_mapping.csv with emp_username column only. You have to stored allowed username in this file. If logged in username is available in user_mapping.csv file then dashboard's panel will display otherwise it will display Access Denied. Here I have used sample panels and searches.

<dashboard>
  <label>Dashboard using login person</label>
  <search>
      <query>| inputlookup user_mapping.csv where emp_username="$env:user$" | stats count</query>
      <progress>
        <condition match="'result.count' == &quot;0&quot;">
          <unset token="employee_rights"/>
          <set token="access_denied">true</set>
        </condition>
        <condition>
          <unset token="access_denied"/>
          <set token="employee_rights">true</set>
        </condition>
      </progress>
    </search>
    <row>
    <panel depends="$access_denied$">
      <html>
        <h1>$env:user$ : Access Denied.</h1>
      </html>
    </panel>
    </row>
  <row>
    <panel depends="$employee_rights$">
      <table>
        <title>Dashboard Panel - 1</title>
        <search>
          <query>| inputlookup user_mapping.csv</query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel depends="$employee_rights$">
      <table>
        <title>Dashboard Panel - 2</title>
        <search>
          <query>| inputlookup user_mapping.csv</query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Please let me know for further assistance.

Thanks
Kamlesh

crasgele · ‎04-16-2019

Thanks for the answer kamlesh_vaghela. I had the same issue and this works fine.

cmerriman · ‎01-12-2018

you'll want to create a conditional token for these possibilities and use depends on the panels you want to populate.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens#Search_tokens_for_dynamic_display_...
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML#Shared_att...

something like this where the search with employee column resides (and do the same logic for manager, creating a token called manager):

 <progress>
       <condition match="'result.employee' == name">
           <set token="employee">true</set>
       </condition>
       <condition>
           <unset token="employee"/>
       </condition>
   </progress>

then, in the panels you want to hide/show, use <panel depends=$employee$> and <panel depends=$manager$> or a combination of both

if criteria matches a in my control file then show or hide a dashboard

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?