Knowledge Management

Datamodel dashboard view access without index permission

mmoermans
Path Finder

For security reasons there's users we don't want to give access to network indexes, yet they still need to view some things.
So in order to allow users to search for specific things we're trying to set up a dashboard which uses the Network_Traffic datamodel and shows results.

Yet whatever permissions I set none work for the user to view the datamodel results (No access to index, read rights to datamodel).

How do you set this up?

Tags (1)

rjthibod
Champion

To my knowledge, there is no way you can let them access the data directly. This is because the datamodel doesn't know if the data is going to be accelerated or not when the unprivileged users access it, so the datamodel has to assume that it will need to access the raw index at some point when those users come calling.

My suggestions is you will need to either get the data those users need via a saved search that can then right out the data to another knowledge object or search artifact that those users can access, or you can run a scheduled saved search against the datamodel that writes the data the unprivileged users will need to a summary index.

Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...