Splunk Search

Use role's "restrict search terms" in complex search

afaraino
Explorer

Hi everyone,
I'm having different roles with different restrict search terms. However, in my dashboards, a drop down list is populated with this search :
| metadata type=hosts

So my user can choose a host that he can't use (dashboard remains empty). Is there a variable I can insert in my populatingSearch?

Thanks for your help

Tags (2)
0 Karma

hazekamp
Builder

Search filters DO NOT work with generating search commands such as "| metadata" or "| inputlookup". To achieve the desired functionality and depending on your role filters you may need to set up role specific metadata host listings. This would mean instantiating the default summary page with additional filters on the "| metadata" commands for each role.

For instance:
| metadata type=hosts | search host=A OR host=B

0 Karma

alexiri
Communicator

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work:

[| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format]

username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this:

( ( ( contact="jimbo" OR contact="jones" ) ) )

which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction?

0 Karma

hazekamp
Builder

Yes, summary page for each role. You can make less "Hard-coded" by setting up macros or a saved search that you can change w/o having to go back to the view XML each time.

0 Karma

afaraino
Explorer

Do you mean a summary page for each role? Hard-coded?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...