Getting Data In

NMON ADDON: permissions

verbal_666
Contributor

Hi there.
As in subject, how to make NMON aggregated data available NOT ONLY TO ADMIN users?
I can query alla data from NMON since i'm admin in System, but i would like to make some metrics available to public normal users Dashboards, all query from normal users returns no data... how to? I tried to give read grant to ALL in all nmon eventtypes, but with no success. Should i have to edit ALL NMON objects??? 😢😢😢
Thanks 👍

Labels (1)
Tags (1)
0 Karma
1 Solution

verbal_666
Contributor

Still have read for all users for the App.

I solved the issue with metadata editing.
For some reason i got a

 

 

[]
owner = admin
access = read : [ admin ], write : [ admin ]

 

 

And many other objects with same grants.

I simply deleted all the single grants for single objects and gave full general access with,

 

 

[]
owner = admin
access = read : [ * ], write : [ admin ]

 

 

Restarted all Splunk SearchHead daemons (clustered) and things now are OK!!! I can query with User.Role and get all fields extracted by NMON conf 😇

View solution in original post

0 Karma

matt8679
Path Finder

You need to add the nmon indexes to your user roles, or create a new role for the nmon users.

Go to: Settings > roles > "your user role" > Indexes tab > "select indexes"

You should see the following indexes for the nmon data:
os-unix-nmon-config

os-unix-nmon-events

os-unix-nomon-internal

os-unix-nmon-metircs

0 Karma

verbal_666
Contributor

🤔

 

... i'm using only 1 index for NMON,

 

index=*nmon* | dedup index | table index
nmon

 

🤔🤔🤔

0 Karma

matt8679
Path Finder

Okay,  just add the nmon index to your user role that needs access.

 

0 Karma

verbal_666
Contributor

Another method is to schedule an admin alert and log the data inside a public access index or a metric index, and then get nmon data from there, where "user role" can query... but i then need to extract all nmon data in field, since the original ones are only admin 😣

0 Karma

verbal_666
Contributor

Role still has "nmon" index access... i can query "nmon", but can't get all eventtypes and metrics... i think the first install of NMON ADDON gave all nmon objects only "admin" rights... 🙄 ... maybe i can see inside metadata path and correct all the "access =" parameter 😔

0 Karma

matt8679
Path Finder

I see... you need to make the nmon app global or accessible to those users

Click apps > Manage apps > NMON app > Permissions Read/Wright all

Make app accessible to users.

Are your users able to access the NMON app? If you don't want the app global, the users will only have the knowledge objects available within the NMON app.

0 Karma

verbal_666
Contributor

Still have read for all users for the App.

I solved the issue with metadata editing.
For some reason i got a

 

 

[]
owner = admin
access = read : [ admin ], write : [ admin ]

 

 

And many other objects with same grants.

I simply deleted all the single grants for single objects and gave full general access with,

 

 

[]
owner = admin
access = read : [ * ], write : [ admin ]

 

 

Restarted all Splunk SearchHead daemons (clustered) and things now are OK!!! I can query with User.Role and get all fields extracted by NMON conf 😇

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...