Users with new Role cannot see flashtimeline view

[Ant1D]

Hey,

I just created a new Role for my Splunk instance.

Since I have created this role, the flashtimeline view will not load for this user. Instead users with this role receive the following message when the flashtimeline view is accessed:

Splunk cannot find the "flashtimeline" view. It may have been renamed or moved. Try removing the page refrerence from this favourite address and refreshing.

When I go to Manager->User interface->Views->flashtimeline permissions, read access is set to Everyone including the new role for All apps. What could be causing this message to appear? Is it a capability issue? (I doubt that the capability is the problem).

When I look at the App dropdown list (top right of screen) the default Search app that comes with Splunk cannot be found in the list for users that have this new role. Could that be the problem? Help please 🙂

Thanks in advance for your help.

[bfaber · Accepted solution]

Does the new role inherit the 'user' role? Doing so may solve your issue.

[Ant1D · Accepted solution]

I had a thought, put it to the test and it seems to have solved my issue.

Users with the new role cannot select the 'Search' app from the App dropdown menu. The 'flashtimeline' view belongs to the 'Search' app (probably explains the bold message above).

So...I just copied over the 'flashtimeline' view file from the 'Search' app directory into the following location: \\default\data\ui\views folder

After a Splunk restart, users with the new role can now use the flastimeline view in MY_APP (e.g. when a drilldown on a table result is performed).

I hope this helps.

[bfaber · Accepted solution]

Does the new role inherit the 'user' role? Doing so may solve your issue.

[Ant1D]

The role does not inherit the user role. This is because although I want it to behave like a user role, I wanted to restrict this new role so that it can only see data from specific sourcetypes. I have cloned the user role by adding the same capabilities to this new role that the default user role has but this has not solved the issue.

[jrodman]

This is where you probably want to start. Practically speaking, the rest_apps_view capability is almost certainly required, as well as rest_properties_get. Of course for the view to work, you'll need the search capability, and if you want the summary view you'll need get_metadata. For the full interactivity to work you'll need get_typeahead, ... pretty soon you've cloned or inherited the user role.