Security

Search works with admin but not with user

ddarmand
Communicator

Hello Splunk users,

I have got a dashboard with this :

<module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" autoRun="True">
        <param name="search">| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024,3) | eval totalGB=round(total/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top</param>
        <module name="ViewstateAdapter">
            <param name="suppressionList">
                <item>charting.chart</item>
                <item>charting.chart.stackMode</item>
                <item>charting.axisTitleX.visibility</item>
                <item>charting.drilldown</item>
                <item>charting.chart.sliceCollapsingThreshold</item>
                <item>charting.axisY.scale</item>
                <item>charting.axisX.scale</item>
                <item>charting.chart.style</item>
                <item>charting.legend.labelStyle.overflowMode</item>
                <item>charting.legend.placement</item>
                <item>charting.layout.splitSeries</item>
                <item>charting.chart.nullValueMode</item>
                <item>charting.axisTitleY.visibility</item>
            </param>
            <module name="HiddenFieldPicker">
                <param name="strictMode">True</param>
                <module name="JobProgressIndicator">
                    <module name="EnablePreview">
                        <param name="display">False</param>
                        <param name="enable">True</param>
                        <module name="HiddenChartFormatter">
                            <param name="charting.chart">fillerGauge</param>
                            <param name="charting.axisTitleX.visibility">visible</param>
                            <param name="charting.drilldown">all</param>
                            <param name="charting.chart.sliceCollapsingThreshold">0.01</param>
                            <param name="charting.axisY.scale">linear</param>
                            <param name="charting.axisX.scale">linear</param>
                            <param name="charting.chart.style">shiny</param>
                            <param name="charting.axisTitleY.visibility">visible</param>
                            <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param>
                            <param name="charting.legend.placement">right</param>
                            <param name="charting.layout.splitSeries">0</param>
                            <param name="charting.chart.nullValueMode">gaps</param>
                            <param name="charting.chart.stackMode">default</param>
                            <module name="JSChart">
                                <param name="width">100%</param>
                            </module>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>

But it doesn't work if i am logged with an user account and i allowed users role to search into internal_index, what should i add for make this working ?

Thanks,

Damien

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ddarmand,

this is a role capability problem, a user needs to have the capability

  • license_edit

to be able to use this REST search | rest /services/licenser/pools.

Now it's up to you, if you want to grant this to the users role or create a new role for curtain users only.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ddarmand,

this is a role capability problem, a user needs to have the capability

  • license_edit

to be able to use this REST search | rest /services/licenser/pools.

Now it's up to you, if you want to grant this to the users role or create a new role for curtain users only.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you're welcome 🙂

0 Karma

ddarmand
Communicator

Thanks MuS, it works !

Damien

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...