working with metadata output.

[sanju005ind]

I have an environment where there are about 2000 hosts. All the hosts are tagged according to the geographic locations and the sourcetype(AD,DNS,DHCP). User are restricted to logs from hosts which belong to their country using roles. I would like each user to see on the default dashboard the hosts which they have access to the last reported date and the tag.

I use the following query "| metadata type=hosts | fields + host, firstTime, lastTime,totalCount | convert ctime(firstTime) | convert ctime(lastTime) | sort - host | TAGS "

However it displays all the hosts. How can I facilitate the users to see only the hosts that belong to them on the dashboard?

[gkanapathy · Accepted solution]

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

[thall79]

The only way I have been able to filter the events while using | metadata type=host is to add a search host=srv* or use tags (tag=your_tag) to only search on that group of servers.

My next question would be if you are wanting to only create 1 dashboard for each team to use? If so this solution will not work and I am not sure if the is way to read the roles and insert that while using | metadata.

You could always clone the dashboard for each team and put in the filters associated with that team. Then give them the permissions to see that dashboard and not the other teams dashboard.

Travis.

[thall79]

Yes after looking at the post I did leave out important information, good catch there. Here is what I am using when filtering by tags: | metadata type=hosts | tags host | search NOT tag::host=remove | search host=*

[Simeon]

sounds like this could be a bug. what is the restrict filter you are using?