Dashboards & Visualizations

problem with roles and dashboards?

laristote
Explorer

Hello,

I have several roles which limit data access based on search filters.

When they use the same report, users with different roles obtain different results according to the data they can access.

But when this report is configured in a dashboard, the users have access to all the data. There is no limitation anymore. It behaves as if the roles have no search filter.

Is there a problem with the permissions?

Thanks

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

I believe that what you are using is a dashboard that is populated by a scheduled search. Even if the limited user role does not have access to the index where the data is actually stored, they will have access to the cached search results from a search that operates on that index. The solution is to also remove the access rights to the saved search.

Basically, if you have the right to run a certain saved search (regardless of additional restrictions), you have the right to see the cached search results from that search - even if those results are the output of another users (with 'better' access rights) run of the same search.

hope this helps,

K

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...