Splunk Search

Splunk DB Connect: Is it possible to restrict users from running dbquery command, but still access the dashboard/report populated by dbquery?

benjaminlin1019
Explorer

I am looking for a way to restrict users to run "dbquery" command but still be able to access the dashboard/report that made by running "dbquery", is that even possible? I tried to use dbx/metadata/local.meta to have testrole to be able to see the dashboard/report but not able to run dbquery command, but it doesn't work that way.

[commands/dbquery]
access = read : [ dbx_user, admin ], write : [ dbx_user, admin ]
export = system

[database/mydb]
access = read : [ admin, dbx_user, testrole ], write : [ admin, dbx_user ]
export = none

0 Karma

lguinn2
Legend

AFAIK, you can't do it that way. However, you could have a scheduled search with a dbquery that populates a lookup table, and then have the dashboard reports use the lookup table. The dashboard data would be relatively stale, depending on how often the schedule search runs.

Another alternative is to use an embedded report. In this case, your report would still use dbquery - and it would still have to be scheduled - but you could skip the lookup table. Here is a nice blog entry that shows how: Embed scheduled reports

In both of these examples, you could deny access to the DBConnect app to the users.

As a general rule, if you don't have access to the data and commands that underly a report, you can't use the report. Embedded reports were designed to get around this restriction. In addition, embedded reports can be viewed without even logging into Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...