Hi,
I'm currently trying to restrict specific users from viewing certain panels in search app. Sadly juggling around in /data/ui/views/ and metadata didn't do the trick.
How can I hide certain panels like Pivot, Alerts or Reports from a user via permissions?
Thanks in advance!
Regards,
pyro_wood
@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.
https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html
In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:
Call REST API to get logged in User Role. Using REST call
/services/authentication/current-contex, only if the logged in user hasadminrole associated, set theaccesstoken, else unset theaccesstoken.Add
dependsattribute with tokenaccessto the dashboard element/s to be hidden. In this example<panel depends="$access">
Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:
<form>
<label>Hide Panels based on Role</label>
<search base="baseUserRolesRESTSearch">
<query>| search NOT roles="admin"
</query>
<done>
<!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
<condition match="$job.resultCount$==0">
<set token="access">enabled</set>
</condition>
<!-- Hence admin role is not attached with logged in user -->
<condition>
<unset token="access"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input id="time1" type="time" token="tokTime" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>$env:user$ Access based on role: $access$</title>
<search id="baseUserRolesRESTSearch">
<query>| rest splunk_server=local /services/authentication/current-context
| table roles
</query>
</search>
<option name="underLabel">Logged in user ( $env:user$ ) roles</option>
</single>
<html>
<div>
<p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
</div>
</html>
</panel>
</row>
<row>
<panel depends="$access$">
<table>
<title>Top 5 Splunk Components with Errors</title>
<search>
<query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
</table>
</panel>
</row>
</form>
@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.
https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html
In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:
Call REST API to get logged in User Role. Using REST call
/services/authentication/current-contex, only if the logged in user hasadminrole associated, set theaccesstoken, else unset theaccesstoken.Add
dependsattribute with tokenaccessto the dashboard element/s to be hidden. In this example<panel depends="$access">
Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:
<form>
<label>Hide Panels based on Role</label>
<search base="baseUserRolesRESTSearch">
<query>| search NOT roles="admin"
</query>
<done>
<!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
<condition match="$job.resultCount$==0">
<set token="access">enabled</set>
</condition>
<!-- Hence admin role is not attached with logged in user -->
<condition>
<unset token="access"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input id="time1" type="time" token="tokTime" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>$env:user$ Access based on role: $access$</title>
<search id="baseUserRolesRESTSearch">
<query>| rest splunk_server=local /services/authentication/current-context
| table roles
</query>
</search>
<option name="underLabel">Logged in user ( $env:user$ ) roles</option>
</single>
<html>
<div>
<p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
</div>
</html>
</panel>
</row>
<row>
<panel depends="$access$">
<table>
<title>Top 5 Splunk Components with Errors</title>
<search>
<query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
</table>
</panel>
</row>
</form>
