Enabling splunk cloud iframe

[shoaibalimir]

The use case is such that we want to integrate the Datadog dashboard into splunkcloud using iframe feature. However by default splunk restricts the iframe option. Can we enable that feature or use any other alternative for the provided use case.

[VatsalJagani]

@shoaibalimir - You can enable in your $SPLUNK_HOME/etc/system/local/web.conf config file.

https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-referen...

dashboard_html_allow_embeddable_content = <boolean>
* Whether or not to allow <embed> and <iframe> HTML elements in dashboards.
* If set to "true", <embed> and <iframe> HTML elements in dashboards will not be removed
  and can lead to a potential security risk.
* If set to the default value of "false", <embed> and <iframe> HTML elements will be stripped
  from the dashboard HTML.
* Default: false

Some related options in web.conf

dashboard_html_wrap_embed = <boolean>
* Whether or not to wrap <embed> HTML elements in dashboards with an <iframe>.
* If set to "false", <embed> HTML elements in dashboards will not be wrapped, leading to
  a potential security risk.
* If set to "true", <embed> HTML elements will be wrapped by an <iframe sandbox> element to help
  mitigate potential security risks.
* Default: true

dashboard_html_allow_iframes = <boolean>
* Whether or not to allow iframes from HTML elements in dashboards.
* If "false", iframes from HTML elements in dashboards will be removed to prevent
  potential attacks.
* Default: true

dashboard_html_allowed_domains = <comma-separated list>
* A list of allowed domains for inline iframe element
  source ('<iframe src="<URL>">') attributes in dashboards.
* If the domain for an <iframe> src attribute is not an allowed
  domain, the Simple XML dashboard adds the 'sandbox' attribute to
  the <iframe>, which further restricts the content within the <iframe>
  by treating it as coming from a unique origin. Simple XML dashboards
  will allow <iframe> src attributes by default if the src is the same
  hostname and port number as the Splunk Web server's hostname and port number.
* You can specify these domains as a hostname or an IPV4 address or an IPV6 address.
* You can configure a hostname as a full name or with a wildcard
  to allow for any subdomains. For example, *.example.com would
  allow for any subdomain of example.com as well as example.com itself.
* You can specify an IPV4 address as an exact address or:
  * You can use an asterisk to specify a wildcard (Example: 192.168.1.*).
    Asterisks allow for any address within that byte segment.
  * You can use a dash to specify a range of addresses (Example: 192.168.1.1-99).
    Dashes will only match IP addresses within that range.
* You can specify an IPV6 address either as an exact address or with
  a subnet mask. If you specify a subnet mask, any IPV6 address within
  the subnet will be an allowed domain.
* You can specify a port number for any of the domains. If you do, the '<iframe src>'
  must match the port number as well.
* Additional configuration examples:
  * Hostname: docs.splunk.com, *.splunk.com
  * IPV4: 127.0.0.1, 127.0.0.*, 127.0-10.0.*, 127.0.0.1:8000
  * IPV6: ::1, [::1]:8000, 2001:db8:abcd:12::, 2001:db8::/32
* Default: not set

I hope this helps!!!

[shoaibalimir]

Hi,

Apologies for the delayed response, I checked the response, but we are kind of looking for implementing this on Splunk Cloud. Apologies for the miscommunication if arosed from this.

Is there any other alternatives apart from iFrames, we are happy to explore that as well.

[inventsekar]

@shoaibalimir wrote: 
>>> but we are kind of looking for implementing this on Splunk Cloud.

Dear @shoaibalimir , Could you pls update us more details about "implmenting this on Splunk Cloud"

Are you looking to implement the iframe on Splunk Cloud Classic Dashboard or Dashboard Studio or report / alert / emails, pls provide more details, thanks. 

[Shruti]

We currently maintain several dashboards in Datadog that provide real-time visibility into our systems. Our requirement is to integrate these Datadog dashboards into Splunk Cloud so that users can access them seamlessly within the Splunk interface, without losing any live data capabilities or interactivity.

We initially explored embedding the dashboards using an iFrame approach. However, we understand that Splunk Cloud enforces restrictions on iFrame usage by default, which limits this option.

Our primary objective is to display Datadog dashboards within Splunk Cloud “as-is,” preserving real-time data updates, visualizations, and user interactions, rather than recreating or duplicating the dashboards in Splunk.

We are open to alternative approaches that can achieve this integration, such as secure embedding methods, API-based integrations, or any supported mechanisms within Splunk Cloud that allow external dashboards to be surfaced while maintaining live data fidelity.

We would appreciate guidance on feasible solutions or best practices to achieve this requirement.