Splunk Search

How to block access to the search bar for users in an app?

DavidHourani
Super Champion

Hello,

I would like to create an app where users can only check out the existing dashboards, but cannot run searches themselves.

Is there a way to block the access to the search ui and still allow the users to see dashboard outputs ?

Best regards,
David

1 Solution

jlhamlet
Path Finder

Hi,

@David, hope you solved your problem. Here is what i would do:

1 - Give my "normal users" access to the application containing all my dashboards. (by selecting their roles)
Handle the Users rights by changing the permissions on your app
2- Set a default dashboard. (users will fall on the dashboard as they log on and falls directly on your app)
3- On each dashboard panels, hide the followings:

   <dashboard hideEdit="true">          # will hide on the dashboard: Edit, More Info, export PDF and Print
           ...
<option name="link.openSearch.visible">false</option>   # will hide Open in Search from under the panel
<option name="link.openPivot.visible">false</option>        # will hide Open in Pivot from under the panel
<option name="link.inspectSearch.visible">false</option>   # will hide Inspect from under the panel
<option name="link.exportResults.visible">false</option>     # will hide Export from under the panel

4- The SEARCH page is a "view" that is set to GLOBAL.
so i would change the permissions on that view so that my normal users could not access to it (even by changing the url)

Hope this helps some of you.

Happy Splunking,

Lloyd,

View solution in original post

jlhamlet
Path Finder

Hi,

@David, hope you solved your problem. Here is what i would do:

1 - Give my "normal users" access to the application containing all my dashboards. (by selecting their roles)
Handle the Users rights by changing the permissions on your app
2- Set a default dashboard. (users will fall on the dashboard as they log on and falls directly on your app)
3- On each dashboard panels, hide the followings:

   <dashboard hideEdit="true">          # will hide on the dashboard: Edit, More Info, export PDF and Print
           ...
<option name="link.openSearch.visible">false</option>   # will hide Open in Search from under the panel
<option name="link.openPivot.visible">false</option>        # will hide Open in Pivot from under the panel
<option name="link.inspectSearch.visible">false</option>   # will hide Inspect from under the panel
<option name="link.exportResults.visible">false</option>     # will hide Export from under the panel

4- The SEARCH page is a "view" that is set to GLOBAL.
so i would change the permissions on that view so that my normal users could not access to it (even by changing the url)

Hope this helps some of you.

Happy Splunking,

Lloyd,

DavidHourani
Super Champion

Thanks for your reply M. Lloyd 😉

It Fixed my problem. I replaced:

 <option name="link.openSearch.visible">false</option>   # will hide Open in Search from under the panel
 <option name="link.openPivot.visible">false</option>        # will hide Open in Pivot from under the panel
 <option name="link.inspectSearch.visible">false</option>   # will hide Inspect from under the panel
 <option name="link.exportResults.visible">false</option>     # will hide Export from under the panel

With:

<option name="link.visible">false</option> 

To keep the source small ^^

Thanks for your help!
David

jeffland
SplunkTrust
SplunkTrust

Maybe have a look here?

paramagurukarth
Builder

I don't know about the access level blocking of search bar..
but by changing the css.. you can hide it...
Copy the below code to application.css (MyApp\appserver\static\application.css) of your application

.search-bar{
   display:none !important;
}

paramagurukarth
Builder

Sorry..... My suggestion on application.css won't work as it will be loaded only in dash boards

DavidHourani
Super Champion

Wow thanks a lot man 😄 any idea how i can hide that for normal users only and allow it for users that have a bit more privileges ?

0 Karma

Raghav2384
Motivator

How about
1. create an app by taking out the search/Alerts/Reports views from the nav bar
2. Build all the report content etc
3. Create a role
4. Assign users only to that app?

DavidHourani
Super Champion

That's a smart way to do it but users can still modify the URL and get access to the search bar that way 🙂

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...