Security

Users with new Role cannot see flashtimeline view

Ant1D
Motivator

Hey,

I just created a new Role for my Splunk instance.

Since I have created this role, the flashtimeline view will not load for this user. Instead users with this role receive the following message when the flashtimeline view is accessed:

Splunk cannot find the "flashtimeline" view. It may have been renamed or moved. Try removing the page refrerence from this favourite address and refreshing.

When I go to Manager->User interface->Views->flashtimeline permissions, read access is set to Everyone including the new role for All apps. What could be causing this message to appear? Is it a capability issue? (I doubt that the capability is the problem).

When I look at the App dropdown list (top right of screen) the default Search app that comes with Splunk cannot be found in the list for users that have this new role. Could that be the problem? Help please 🙂

Thanks in advance for your help.

Tags (3)
0 Karma
2 Solutions

bfaber
Communicator

Does the new role inherit the 'user' role? Doing so may solve your issue.

View solution in original post

Ant1D
Motivator

I had a thought, put it to the test and it seems to have solved my issue.

Users with the new role cannot select the 'Search' app from the App dropdown menu. The 'flashtimeline' view belongs to the 'Search' app (probably explains the bold message above).

So...I just copied over the 'flashtimeline' view file from the 'Search' app directory into the following location: \\default\data\ui\views folder

After a Splunk restart, users with the new role can now use the flastimeline view in MY_APP (e.g. when a drilldown on a table result is performed).

I hope this helps.

View solution in original post

0 Karma

Ant1D
Motivator

I had a thought, put it to the test and it seems to have solved my issue.

Users with the new role cannot select the 'Search' app from the App dropdown menu. The 'flashtimeline' view belongs to the 'Search' app (probably explains the bold message above).

So...I just copied over the 'flashtimeline' view file from the 'Search' app directory into the following location: \\default\data\ui\views folder

After a Splunk restart, users with the new role can now use the flastimeline view in MY_APP (e.g. when a drilldown on a table result is performed).

I hope this helps.

0 Karma

bfaber
Communicator

Does the new role inherit the 'user' role? Doing so may solve your issue.

Ant1D
Motivator

The role does not inherit the user role. This is because although I want it to behave like a user role, I wanted to restrict this new role so that it can only see data from specific sourcetypes. I have cloned the user role by adding the same capabilities to this new role that the default user role has but this has not solved the issue.

0 Karma

jrodman
Splunk Employee
Splunk Employee

This is where you probably want to start. Practically speaking, the rest_apps_view capability is almost certainly required, as well as rest_properties_get. Of course for the view to work, you'll need the search capability, and if you want the summary view you'll need get_metadata. For the full interactivity to work you'll need get_typeahead, ... pretty soon you've cloned or inherited the user role.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...