Dashboards & Visualizations

problem with roles and dashboards?

laristote
Explorer

Hello,

I have several roles which limit data access based on search filters.

When they use the same report, users with different roles obtain different results according to the data they can access.

But when this report is configured in a dashboard, the users have access to all the data. There is no limitation anymore. It behaves as if the roles have no search filter.

Is there a problem with the permissions?

Thanks

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

I believe that what you are using is a dashboard that is populated by a scheduled search. Even if the limited user role does not have access to the index where the data is actually stored, they will have access to the cached search results from a search that operates on that index. The solution is to also remove the access rights to the saved search.

Basically, if you have the right to run a certain saved search (regardless of additional restrictions), you have the right to see the cached search results from that search - even if those results are the output of another users (with 'better' access rights) run of the same search.

hope this helps,

K

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...