Security

Is it possible to suppress errors for lookups that are intentionally hidden from certain users?

wryanthomas
Contributor

We have (here at the University) some course dashboards we’re working on. The source data has obfuscated userIDs, and dashboard dev is going swimmingly. We want certain privileged users to be able to view these dashboards with actual (human-friendly) userIDs (we call “netIDs”). I’ve set up an automatic lookup to turn “personID” in to the netID value … but only if the privileged user is in a particular role. I.e., the lookup is only available to users in the 'privileged' role. This works great. The dashboards work for both privileged and unprivileged. (Unprivileged get the obfuscated ID, privileged get the ID from lookup.) However… persons without access to the lookup are getting errors about not being able to locate the lookup. My question: Is it possible to suppress these errors? They’re reporting a lack of access that is intentional. If there is no way to suppress the errors — is there another way to design this? (I don’t want us to have to manage separate sets of dashboards.)

0 Karma

yannK
Splunk Employee
Splunk Employee

If you have automatic lookups, then you should have a way to edit the permissions on it to only apply to certain roles.
That way the user that is not a member should not try and fail and trigger an error.

An automatic lookup is composed of : lookup table, lookup definition, automatic lookup definition
check the permissions of all those 2 objects.

0 Karma

woodcock
Esteemed Legend

Check all 3 KOs.

0 Karma

wryanthomas
Contributor

The lookup is tied to the same field ... so it does trigger, even though the permissions are correct. I.e., your statement, "that way the user that is not a member should not try and fail and trigger an error" does not apply.

The lookup error occurs because the permissions are correct.

If I'm misunderstanding your recommendation, I'd be happy to be helped to a point of understanding.

0 Karma

yannK
Splunk Employee
Splunk Employee

look like 1 of the 3 lookup pieces is missing read permissions.

0 Karma

woodcock
Esteemed Legend

Or wrong permissions scope.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...