Security
Highlighted

Create new App for new Role

Path Finder

Hi there. I need to create a new App, and make it available to new users. Those new users should be able to access only this new App.

So I created a new role, cloned from User, and granted access to the new app and some of my views and saved searches. I've also allowed access to flashtimeline and my eventtypes.

In this new app I have a dashboard with links to my saved searches. The dashboard works fine, but with the links to saved searches, the new users get a 404 error: "404 Not Found

The following requested saved search is unknown: "My Search". As a result, Splunk is unable to redirect to a view."

Also, if I want to access directly to flashtimeline (http://splunk.../app/NewApp/flashtimeline), I get: "404 Not Found

Splunk cannot find the "flashtimeline" view."

What am I doing wrong?

0 Karma
Highlighted

Re: Create new App for new Role

Path Finder

Have you checked in the manager that the searches are not owned by the admin, but by the app? That could cause these error messages. Go to Manager > Searches and reports and check that the owner is the app and not another user.

Edit: What I meant was to check that admin wasn't the owner of the saved searches and that that overrides the app permissions. I'm sorry about the confusion, apps can't own searches.

0 Karma
Highlighted

Re: Create new App for new Role

Super Champion

What do you mean my owned by the app? Do you mean application-level sharing, or given read access to the role associated with the app? As far as I know, there is no concept of an "app" owning anything? (Obviously searches and other objects have to live somewhere, but be defined in an app is not the same as being the "owner" of the apps objects)

0 Karma
Highlighted

Re: Create new App for new Role

Path Finder

No, that's OK.
The thing is (i forgot to mention on my post) if I grant the new user the "User" role, everything works fine.
It's like in some point there's a lack of a permission. Maybe some command?

0 Karma
Highlighted

Re: Create new App for new Role

Path Finder

Did you check the permissions link in the manager > searches and reports? There you can set with roles are able to read the saved search.

0 Karma
Highlighted

Re: Create new App for new Role

Path Finder

Yes, the roles are ok. I suspect that it's not the search the problem, but some view or command (I think so because a search is opened in the flashtimeline).

0 Karma
Highlighted

Re: Create new App for new Role

Super Champion

What version of splunk are you running? Are you sure that "flashtimeline" is accessible to your new role? (It should be by default). Have you setup any navigation for your new app?

0 Karma
Highlighted

Re: Create new App for new Role

Path Finder

I'm running Splunk 4.1.3. We've recently upadated from 4.0.6. My navigation is default, local to my app (readable for everyone). The dashboard is also defined in my app and readable for everyone. The flashtimeline is defined as Global, readable for everyone. I'm trying with one specific search, that is readable for User, Power, and MyNewRole.

0 Karma
Highlighted

Re: Create new App for new Role

Explorer

This happens if the user doesn't have Read access to the Search application. I've started from a fresh install of the beta 4 version of and if you create a user in the Power user role and remove read permissions from the Search app for the Power role you will get this message.

0 Karma
Highlighted

Re: Create new App for new Role

Motivator

How do you set a new role to have read access to the Search app

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.