Splunk Search
Highlighted

Use role's "restrict search terms" in complex search

Explorer

Hi everyone,
I'm having different roles with different restrict search terms. However, in my dashboards, a drop down list is populated with this search :
| metadata type=hosts

So my user can choose a host that he can't use (dashboard remains empty). Is there a variable I can insert in my populatingSearch?

Thanks for your help

Tags (2)
0 Karma
Highlighted

Re: Use role's "restrict search terms" in complex search

Builder

Search filters DO NOT work with generating search commands such as "| metadata" or "| inputlookup". To achieve the desired functionality and depending on your role filters you may need to set up role specific metadata host listings. This would mean instantiating the default summary page with additional filters on the "| metadata" commands for each role.

For instance:
| metadata type=hosts | search host=A OR host=B

0 Karma
Highlighted

Re: Use role's "restrict search terms" in complex search

Explorer

Do you mean a summary page for each role? Hard-coded?

0 Karma
Highlighted

Re: Use role's "restrict search terms" in complex search

Builder

Yes, summary page for each role. You can make less "Hard-coded" by setting up macros or a saved search that you can change w/o having to go back to the view XML each time.

0 Karma
Highlighted

Re: Use role's "restrict search terms" in complex search

Communicator

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work:

[| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format]

username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this:

( ( ( contact="jimbo" OR contact="jones" ) ) )

which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction?

0 Karma