Hello,
I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "user_read_only" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "user_read_only" and "user":
- Search
- Datasets
- Reports
- Alerts
And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):
Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoa_user" and "user_ad_user" to the "user_read_only" Role.
When Clicking in the ITSI link from App menu the page crash:
So doing a search in the index="_internal" with the given request ID, it shows several errors like:
An unknown view name "search" is referenced in the navigation definition for "itsi"
source = /opt/splunk/var/log/splunk/web_service.log
sourcetype = splunk_web_service
Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?
Thanks a lot,
Edoardo
