Dashboards & Visualizations

problem with roles and dashboards?

laristote
Explorer

Hello,

I have several roles which limit data access based on search filters.

When they use the same report, users with different roles obtain different results according to the data they can access.

But when this report is configured in a dashboard, the users have access to all the data. There is no limitation anymore. It behaves as if the roles have no search filter.

Is there a problem with the permissions?

Thanks

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

I believe that what you are using is a dashboard that is populated by a scheduled search. Even if the limited user role does not have access to the index where the data is actually stored, they will have access to the cached search results from a search that operates on that index. The solution is to also remove the access rights to the saved search.

Basically, if you have the right to run a certain saved search (regardless of additional restrictions), you have the right to see the cached search results from that search - even if those results are the output of another users (with 'better' access rights) run of the same search.

hope this helps,

K

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...