Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- What is the configuration required to create a vie...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to create a role where the user is not able to search Splunk. They should only be able to view dashboards that have been pre-populated by scheduled searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is what you can do
Create a User Role, say read-only-user with following capabilities:-
change_own_password
get_metadata
rest_properties_get
searchGo to Manager Apps and for Sharing permission for app 'Search & Reporting', give read permission to all roles except 'read-only-user' role. By default Read is assigned to 'Everyone'
For Splunk Apps that user in role 'read-only-user' should access, change the home page from 'search' to appropriate dashboard. Otherwise, they'll get error while opening the App.
You should be all set.
List item
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
would this be an appropriate way to complete this?
https://answers.splunk.com/answers/550347/how-to-create-dashboard-app.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is what you can do
Create a User Role, say read-only-user with following capabilities:-
change_own_password
get_metadata
rest_properties_get
searchGo to Manager Apps and for Sharing permission for app 'Search & Reporting', give read permission to all roles except 'read-only-user' role. By default Read is assigned to 'Everyone'
For Splunk Apps that user in role 'read-only-user' should access, change the home page from 'search' to appropriate dashboard. Otherwise, they'll get error while opening the App.
You should be all set.
List item
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
