Search works with admin but not with user

[ddarmand]

Hello Splunk users,

I have got a dashboard with this :

<module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" autoRun="True">
        <param name="search">| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024,3) | eval totalGB=round(total/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top</param>
        <module name="ViewstateAdapter">
            <param name="suppressionList">
                <item>charting.chart</item>
                <item>charting.chart.stackMode</item>
                <item>charting.axisTitleX.visibility</item>
                <item>charting.drilldown</item>
                <item>charting.chart.sliceCollapsingThreshold</item>
                <item>charting.axisY.scale</item>
                <item>charting.axisX.scale</item>
                <item>charting.chart.style</item>
                <item>charting.legend.labelStyle.overflowMode</item>
                <item>charting.legend.placement</item>
                <item>charting.layout.splitSeries</item>
                <item>charting.chart.nullValueMode</item>
                <item>charting.axisTitleY.visibility</item>
            </param>
            <module name="HiddenFieldPicker">
                <param name="strictMode">True</param>
                <module name="JobProgressIndicator">
                    <module name="EnablePreview">
                        <param name="display">False</param>
                        <param name="enable">True</param>
                        <module name="HiddenChartFormatter">
                            <param name="charting.chart">fillerGauge</param>
                            <param name="charting.axisTitleX.visibility">visible</param>
                            <param name="charting.drilldown">all</param>
                            <param name="charting.chart.sliceCollapsingThreshold">0.01</param>
                            <param name="charting.axisY.scale">linear</param>
                            <param name="charting.axisX.scale">linear</param>
                            <param name="charting.chart.style">shiny</param>
                            <param name="charting.axisTitleY.visibility">visible</param>
                            <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param>
                            <param name="charting.legend.placement">right</param>
                            <param name="charting.layout.splitSeries">0</param>
                            <param name="charting.chart.nullValueMode">gaps</param>
                            <param name="charting.chart.stackMode">default</param>
                            <module name="JSChart">
                                <param name="width">100%</param>
                            </module>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>

But it doesn't work if i am logged with an user account and i allowed users role to search into internal_index, what should i add for make this working ?

Thanks,

Damien

[MuS · Accepted solution]

Hi ddarmand,

this is a role capability problem, a user needs to have the capability

• license_edit

to be able to use this REST search | rest /services/licenser/pools.

Now it's up to you, if you want to grant this to the users role or create a new role for curtain users only.

hope this helps ...

cheers, MuS

[MuS]

you're welcome 🙂

[ddarmand]

Thanks MuS, it works !

Damien