Hi there. I need to create a new App, and make it available to new users. Those new users should be able to access only this new App.
So I created a new role, cloned from User, and granted access to the new app and some of my views and saved searches. I've also allowed access to flashtimeline and my eventtypes.
In this new app I have a dashboard with links to my saved searches. The dashboard works fine, but with the links to saved searches, the new users get a 404 error: "404 Not Found
The following requested saved search is unknown: "My Search". As a result, Splunk is unable to redirect to a view."
Also, if I want to access directly to flashtimeline (http://splunk.../app/NewApp/flashtimeline), I get: "404 Not Found
Splunk cannot find the "flashtimeline" view."
What am I doing wrong?
Have you checked in the manager that the searches are not owned by the admin, but by the app? That could cause these error messages. Go to Manager > Searches and reports and check that the owner is the app and not another user.
Edit: What I meant was to check that admin wasn't the owner of the saved searches and that that overrides the app permissions. I'm sorry about the confusion, apps can't own searches.
What do you mean my owned by the app? Do you mean application-level sharing, or given read access to the role associated with the app? As far as I know, there is no concept of an "app" owning anything? (Obviously searches and other objects have to live somewhere, but be defined in an app is not the same as being the "owner" of the apps objects)
No, that's OK.
The thing is (i forgot to mention on my post) if I grant the new user the "User" role, everything works fine.
It's like in some point there's a lack of a permission. Maybe some command?
Yes, the roles are ok. I suspect that it's not the search the problem, but some view or command (I think so because a search is opened in the flashtimeline).
What version of splunk are you running? Are you sure that "flashtimeline" is accessible to your new role? (It should be by default). Have you setup any navigation for your new app?
I'm running Splunk 4.1.3. We've recently upadated from 4.0.6. My navigation is default, local to my app (readable for everyone). The dashboard is also defined in my app and readable for everyone. The flashtimeline is defined as Global, readable for everyone. I'm trying with one specific search, that is readable for User, Power, and MyNewRole.
This happens if the user doesn't have Read access to the Search application. I've started from a fresh install of the beta 4 version of and if you create a user in the Power user role and remove read permissions from the Search app for the Power role you will get this message.