Dashboards & Visualizations

working with metadata output.

sanju005ind
Communicator

I have an environment where there are about 2000 hosts. All the hosts are tagged according to the geographic locations and the sourcetype(AD,DNS,DHCP). User are restricted to logs from hosts which belong to their country using roles. I would like each user to see on the default dashboard the hosts which they have access to the last reported date and the tag.

I use the following query "| metadata type=hosts | fields + host, firstTime, lastTime,totalCount | convert ctime(firstTime) | convert ctime(lastTime) | sort - host | TAGS "

However it displays all the hosts. How can I facilitate the users to see only the hosts that belong to them on the dashboard?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

i don't see you using the |tags search command and then filtering based on that. The |metadata command won't list tags (as you can see if you just run it standalone), so you need to first apply the |tags command, then filter on, e.g., |search tags=blah*.

thall79
Communicator

The only way I have been able to filter the events while using | metadata type=host is to add a search host=srv* or use tags (tag=your_tag) to only search on that group of servers.

My next question would be if you are wanting to only create 1 dashboard for each team to use? If so this solution will not work and I am not sure if the is way to read the roles and insert that while using | metadata.

You could always clone the dashboard for each team and put in the filters associated with that team. Then give them the permissions to see that dashboard and not the other teams dashboard.

Travis.

0 Karma

thall79
Communicator

Yes after looking at the post I did leave out important information, good catch there. Here is what I am using when filtering by tags: | metadata type=hosts | tags host | search NOT tag::host=remove | search host=*

0 Karma

Simeon
Splunk Employee
Splunk Employee

sounds like this could be a bug. what is the restrict filter you are using?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...