Restrict search terms & tstats

[ccsfdave]

Greetings,

I have a dashboard panel the runs the following:

| tstats sum(bytes_sent) AS sumSent sum(bytes_received) AS sumReceived FROM pan_traffic groupby _time span=5m | timechart span=5m values("sumReceived") AS "Bytes Received" values("sumSent") AS "Bytes Sent"

Groups with restricted search terms access this dashboard but their restrictions (on IP subnets) do not trigger and thus they can see all the results.

Is there anything I can do about this?

Thanks!

[ccsfdave · Accepted solution]

The issue here was the user didn't have access to the data I was reporting on because the data was in a different Splunk app. Once I granted access to that app, everything worked.

It would be nice to be able to share data between apps w/o granting access to the app directly.