Splunk Search

Splunk DB Connect: Is it possible to restrict users from running dbquery command, but still access the dashboard/report populated by dbquery?


I am looking for a way to restrict users to run "dbquery" command but still be able to access the dashboard/report that made by running "dbquery", is that even possible? I tried to use dbx/metadata/local.meta to have testrole to be able to see the dashboard/report but not able to run dbquery command, but it doesn't work that way.

access = read : [ dbx_user, admin ], write : [ dbx_user, admin ]
export = system

access = read : [ admin, dbx_user, testrole ], write : [ admin, dbx_user ]
export = none

0 Karma


AFAIK, you can't do it that way. However, you could have a scheduled search with a dbquery that populates a lookup table, and then have the dashboard reports use the lookup table. The dashboard data would be relatively stale, depending on how often the schedule search runs.

Another alternative is to use an embedded report. In this case, your report would still use dbquery - and it would still have to be scheduled - but you could skip the lookup table. Here is a nice blog entry that shows how: Embed scheduled reports

In both of these examples, you could deny access to the DBConnect app to the users.

As a general rule, if you don't have access to the data and commands that underly a report, you can't use the report. Embedded reports were designed to get around this restriction. In addition, embedded reports can be viewed without even logging into Splunk.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...