Splunk Search

Restrict search terms & tstats

ccsfdave
Builder

Greetings,

I have a dashboard panel the runs the following:

| tstats sum(bytes_sent) AS sumSent sum(bytes_received) AS sumReceived FROM pan_traffic groupby _time span=5m | timechart span=5m values("sumReceived") AS "Bytes Received" values("sumSent") AS "Bytes Sent"

Groups with restricted search terms access this dashboard but their restrictions (on IP subnets) do not trigger and thus they can see all the results.

Is there anything I can do about this?

Thanks!

0 Karma
1 Solution

ccsfdave
Builder

The issue here was the user didn't have access to the data I was reporting on because the data was in a different Splunk app. Once I granted access to that app, everything worked.

It would be nice to be able to share data between apps w/o granting access to the app directly.

View solution in original post

ccsfdave
Builder

The issue here was the user didn't have access to the data I was reporting on because the data was in a different Splunk app. Once I granted access to that app, everything worked.

It would be nice to be able to share data between apps w/o granting access to the app directly.

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...