Dashboards & Visualizations

working with metadata output.

sanju005ind
Communicator

I have an environment where there are about 2000 hosts. All the hosts are tagged according to the geographic locations and the sourcetype(AD,DNS,DHCP). User are restricted to logs from hosts which belong to their country using roles. I would like each user to see on the default dashboard the hosts which they have access to the last reported date and the tag.

I use the following query "| metadata type=hosts | fields + host, firstTime, lastTime,totalCount | convert ctime(firstTime) | convert ctime(lastTime) | sort - host | TAGS "

However it displays all the hosts. How can I facilitate the users to see only the hosts that belong to them on the dashboard?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

thall79
Communicator

The only way I have been able to filter the events while using | metadata type=host is to add a search host=srv* or use tags (tag=your_tag) to only search on that group of servers.

My next question would be if you are wanting to only create 1 dashboard for each team to use? If so this solution will not work and I am not sure if the is way to read the roles and insert that while using | metadata.

You could always clone the dashboard for each team and put in the filters associated with that team. Then give them the permissions to see that dashboard and not the other teams dashboard.

Travis.

0 Karma

thall79
Communicator

Yes after looking at the post I did leave out important information, good catch there. Here is what I am using when filtering by tags: | metadata type=hosts | tags host | search NOT tag::host=remove | search host=*

0 Karma

Simeon
Splunk Employee
Splunk Employee

sounds like this could be a bug. what is the restrict filter you are using?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...