I have a dashboard that shows me some simple metrics in real-time. These are displayed as a mixture of "single" values and "radialGauges"
I have created a special user to use to view this dashboard who has restricted rights.
The have rights to this app only and they are a member of their own role. The user_role I created for them is a member of the "users" and "power" users groups.
The user_role group has the dashboard app as its default, is limited to 12 concurrent search jobs, 12 concurrent real-time search jobs and is limited to 100mb for jobs disk quota.
When I login as my admin user the dashboard runs fine without any errors and the radialgauges appear AOK.
When I login as this user and access the dashboard I get an error in red that states:
"Search Operation 'gauge' is unknown. You might not have permission to run this program."
and the radialGauges do not appear.
In my home.xml (the dashboard view) I have gauge configurations similar to:
index="windows_perfmon" host="ps*4sql*" counter="% Processor Time" | stats avg(Value) as CPU | eval CPU=round(CPU,2) | gauge CPU 0 25 75 100
SQL Server CPU Utilisation rt rt
I am using Splunk 4.3.2 Build 123586.
I really don't want to run my dashboard as admin! Anyone have any ideas?