Hi,
We recently migrated to new servers and upgraded to Splunk 6.1.1. One of our our dashboards, the db connect reports are blank, and an error icon appears, with the message "there is no such database available for this user". As an admin, I can see this feed, and it works. Do I need to do something to make it available to everyone? (Oh yeah, we implemented ldap and new roles as well...)
I'm using this to develop customer-facing apps, and each customer should have access to ONLY their own database (shouldn't have access to any other customers' databases).
Here's what I ended up doing:
NOTE: if you set "user" to read or read/write, then every new role you created (user-username) that inherits the "user" role will have access to that database. That's why I specify the "user" role as not having either read or write access above.
You can check to make sure your database permissions are set correctly for each user by logging in as that user and going to the DB Connect app and looking at the list of databases available on either the "Database Info" or the "Database Query" pages.
This process is also described on this documentation page (without the quirks I discovered because of my implementation, which is a little strange in the overall scheme of things in Splunk): http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Setupuserpermissions
NOTE: I also tried just adding the dbx_user's capabilities to my new user's role (without forcing inheritance of the dbx_user), but that didn't seem to cut it. Not sure why that didn't work, but it didn't.
As a side note, I got this through working with Splunk support.
I've been looking at restricting privs and have hit the same error message unless I grant admin_all_objects to my users role.
Not yet. Working with support.
I have the same problem as you... have you fixed this issue yet ?
That sounds like a lot of changes. You might be best off submitting a support case so that Splunk support can take a look at a diag file.