Security

Is it possible to suppress errors for lookups that are intentionally hidden from certain users?

wryanthomas
Contributor

We have (here at the University) some course dashboards we’re working on. The source data has obfuscated userIDs, and dashboard dev is going swimmingly. We want certain privileged users to be able to view these dashboards with actual (human-friendly) userIDs (we call “netIDs”). I’ve set up an automatic lookup to turn “personID” in to the netID value … but only if the privileged user is in a particular role. I.e., the lookup is only available to users in the 'privileged' role. This works great. The dashboards work for both privileged and unprivileged. (Unprivileged get the obfuscated ID, privileged get the ID from lookup.) However… persons without access to the lookup are getting errors about not being able to locate the lookup. My question: Is it possible to suppress these errors? They’re reporting a lack of access that is intentional. If there is no way to suppress the errors — is there another way to design this? (I don’t want us to have to manage separate sets of dashboards.)

0 Karma

yannK
Splunk Employee
Splunk Employee

If you have automatic lookups, then you should have a way to edit the permissions on it to only apply to certain roles.
That way the user that is not a member should not try and fail and trigger an error.

An automatic lookup is composed of : lookup table, lookup definition, automatic lookup definition
check the permissions of all those 2 objects.

0 Karma

woodcock
Esteemed Legend

Check all 3 KOs.

0 Karma

wryanthomas
Contributor

The lookup is tied to the same field ... so it does trigger, even though the permissions are correct. I.e., your statement, "that way the user that is not a member should not try and fail and trigger an error" does not apply.

The lookup error occurs because the permissions are correct.

If I'm misunderstanding your recommendation, I'd be happy to be helped to a point of understanding.

0 Karma

yannK
Splunk Employee
Splunk Employee

look like 1 of the 3 lookup pieces is missing read permissions.

0 Karma

woodcock
Esteemed Legend

Or wrong permissions scope.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...