Knowledge Management

Datamodel dashboard view access without index permission

mmoermans
Path Finder

For security reasons there's users we don't want to give access to network indexes, yet they still need to view some things.
So in order to allow users to search for specific things we're trying to set up a dashboard which uses the Network_Traffic datamodel and shows results.

Yet whatever permissions I set none work for the user to view the datamodel results (No access to index, read rights to datamodel).

How do you set this up?

Tags (1)

rjthibod
Champion

To my knowledge, there is no way you can let them access the data directly. This is because the datamodel doesn't know if the data is going to be accelerated or not when the unprivileged users access it, so the datamodel has to assume that it will need to access the raw index at some point when those users come calling.

My suggestions is you will need to either get the data those users need via a saved search that can then right out the data to another knowledge object or search artifact that those users can access, or you can run a scheduled saved search against the datamodel that writes the data the unprivileged users will need to a summary index.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...