Splunk Search

Use role's "restrict search terms" in complex search

afaraino
Explorer

Hi everyone,
I'm having different roles with different restrict search terms. However, in my dashboards, a drop down list is populated with this search :
| metadata type=hosts

So my user can choose a host that he can't use (dashboard remains empty). Is there a variable I can insert in my populatingSearch?

Thanks for your help

Tags (2)
0 Karma

hazekamp
Builder

Search filters DO NOT work with generating search commands such as "| metadata" or "| inputlookup". To achieve the desired functionality and depending on your role filters you may need to set up role specific metadata host listings. This would mean instantiating the default summary page with additional filters on the "| metadata" commands for each role.

For instance:
| metadata type=hosts | search host=A OR host=B

0 Karma

alexiri
Communicator

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work:

[| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format]

username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this:

( ( ( contact="jimbo" OR contact="jones" ) ) )

which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction?

0 Karma

hazekamp
Builder

Yes, summary page for each role. You can make less "Hard-coded" by setting up macros or a saved search that you can change w/o having to go back to the view XML each time.

0 Karma

afaraino
Explorer

Do you mean a summary page for each role? Hard-coded?

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...