Security

Search works with admin but not with user

ddarmand
Communicator

Hello Splunk users,

I have got a dashboard with this :

<module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" autoRun="True">
        <param name="search">| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024,3) | eval totalGB=round(total/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top</param>
        <module name="ViewstateAdapter">
            <param name="suppressionList">
                <item>charting.chart</item>
                <item>charting.chart.stackMode</item>
                <item>charting.axisTitleX.visibility</item>
                <item>charting.drilldown</item>
                <item>charting.chart.sliceCollapsingThreshold</item>
                <item>charting.axisY.scale</item>
                <item>charting.axisX.scale</item>
                <item>charting.chart.style</item>
                <item>charting.legend.labelStyle.overflowMode</item>
                <item>charting.legend.placement</item>
                <item>charting.layout.splitSeries</item>
                <item>charting.chart.nullValueMode</item>
                <item>charting.axisTitleY.visibility</item>
            </param>
            <module name="HiddenFieldPicker">
                <param name="strictMode">True</param>
                <module name="JobProgressIndicator">
                    <module name="EnablePreview">
                        <param name="display">False</param>
                        <param name="enable">True</param>
                        <module name="HiddenChartFormatter">
                            <param name="charting.chart">fillerGauge</param>
                            <param name="charting.axisTitleX.visibility">visible</param>
                            <param name="charting.drilldown">all</param>
                            <param name="charting.chart.sliceCollapsingThreshold">0.01</param>
                            <param name="charting.axisY.scale">linear</param>
                            <param name="charting.axisX.scale">linear</param>
                            <param name="charting.chart.style">shiny</param>
                            <param name="charting.axisTitleY.visibility">visible</param>
                            <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param>
                            <param name="charting.legend.placement">right</param>
                            <param name="charting.layout.splitSeries">0</param>
                            <param name="charting.chart.nullValueMode">gaps</param>
                            <param name="charting.chart.stackMode">default</param>
                            <module name="JSChart">
                                <param name="width">100%</param>
                            </module>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>

But it doesn't work if i am logged with an user account and i allowed users role to search into internal_index, what should i add for make this working ?

Thanks,

Damien

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ddarmand,

this is a role capability problem, a user needs to have the capability

  • license_edit

to be able to use this REST search | rest /services/licenser/pools.

Now it's up to you, if you want to grant this to the users role or create a new role for curtain users only.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ddarmand,

this is a role capability problem, a user needs to have the capability

  • license_edit

to be able to use this REST search | rest /services/licenser/pools.

Now it's up to you, if you want to grant this to the users role or create a new role for curtain users only.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you're welcome 🙂

0 Karma

ddarmand
Communicator

Thanks MuS, it works !

Damien

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...