Search Summary not using account limitation

[iunderwood]

I have added an account limitation to a subset of Splunk users in a role with the following limitation:

sourcetype=weblogic

Searches are limited as I expect. However, the summary page lists all the source types and hosts that are available in the main index. This is not the behavior I expect.

I am using 4.3.4. Can I fix this without having to move all new data to a separate index and creating a further limitation?

[tmeader]

Yeah, they can see the summary data, but won't be able to see any of the actual event data itself. This is due to the fact that the summary page data is all pulled from the internal index (fairly certain). You could either restrict the summary page entirely for those users, or create an alternate "censored" one.

[sdaniels]

You won't be able to limit this on the search app page as far as I have seen. Certainly your users will only see the data you've limited to weblogic but they can see the summary details. I would suggest creating an Advanced XML dasbhoard that provides the search capabilities but that doesn't show summary data.

Something like below and use the same role pre-pended search to limit scope of what the user can search:

<?xml version="1.0"?>
<view template="dashboard.html" stylesheet="dashboard2.css">
    <label>Summary</label>
    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>
    <module name="SearchBar" layoutPanel="splSearchControls-inline">
        <param name="useAssistant">true</param>
        <param name="useTypeahead">true</param>
        <param name="useOwnSubmitButton">False</param>
        <module name="TimeRangePicker">
            <param name="selected">All time</param>
            <param name="searchWhenChanged">False</param>
            <module name="SubmitButton">
                <param name="allowSoftSubmit">True</param>
                <module name="ViewRedirector" layoutPanel="viewHeader">
                    <param name="viewTarget">flashtimeline</param>
                </module>
            </module>
        </module>
    </module>
</view>