Security

Search & Report dropdown list limit

kmattern
Builder

Is it possible to limit the contents of the Search & Reports dropdown list in any view to just the saved searches for the currently logged in user?

I want to set up a system where each user will see his/her saved searches no others.

Tags (3)
0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

It's changed to 250 due to slow page loading time issues.
You can work out a better number by changing the below - please be aware that any upgrade could overwrite your change;

Source file: $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py

Find the code as below;


# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?

pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

sylim_splunk
Splunk Employee
Splunk Employee
0 Karma

kmattern
Builder

So what do I put in the collection tag in default.xml in nav?

0 Karma

somesoni2
Revered Legend

Any user can only see Splunk objects (saved searches/reports) to which he has permission to read. E.g objects which the user created, object to which Read=Everyone is given in sharing permission. You want to limit the dropdown values to just the object created by user?
This should be sufficient to show all the savedsearches to which the user has access under "Searches & Reports" menu.

<nav>
    <view name="flashtimeline" default='true' />
    <collection label="Views">
        <view source="unclassified" />
        <divider />
    </collection>
    <collection label="Searches &amp; Reports">       
        <saved source="unclassified" />
    </collection>
</nav>
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...