Dashboards & Visualizations

problem with roles and dashboards?

laristote
Explorer

Hello,

I have several roles which limit data access based on search filters.

When they use the same report, users with different roles obtain different results according to the data they can access.

But when this report is configured in a dashboard, the users have access to all the data. There is no limitation anymore. It behaves as if the roles have no search filter.

Is there a problem with the permissions?

Thanks

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

I believe that what you are using is a dashboard that is populated by a scheduled search. Even if the limited user role does not have access to the index where the data is actually stored, they will have access to the cached search results from a search that operates on that index. The solution is to also remove the access rights to the saved search.

Basically, if you have the right to run a certain saved search (regardless of additional restrictions), you have the right to see the cached search results from that search - even if those results are the output of another users (with 'better' access rights) run of the same search.

hope this helps,

K

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...