Dashboards & Visualizations

problem with roles and dashboards?

laristote
Explorer

Hello,

I have several roles which limit data access based on search filters.

When they use the same report, users with different roles obtain different results according to the data they can access.

But when this report is configured in a dashboard, the users have access to all the data. There is no limitation anymore. It behaves as if the roles have no search filter.

Is there a problem with the permissions?

Thanks

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

I believe that what you are using is a dashboard that is populated by a scheduled search. Even if the limited user role does not have access to the index where the data is actually stored, they will have access to the cached search results from a search that operates on that index. The solution is to also remove the access rights to the saved search.

Basically, if you have the right to run a certain saved search (regardless of additional restrictions), you have the right to see the cached search results from that search - even if those results are the output of another users (with 'better' access rights) run of the same search.

hope this helps,

K

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...