Splunk Search

Use role's "restrict search terms" in complex search

afaraino
Explorer

Hi everyone,
I'm having different roles with different restrict search terms. However, in my dashboards, a drop down list is populated with this search :
| metadata type=hosts

So my user can choose a host that he can't use (dashboard remains empty). Is there a variable I can insert in my populatingSearch?

Thanks for your help

Tags (2)
0 Karma

hazekamp
Builder

Search filters DO NOT work with generating search commands such as "| metadata" or "| inputlookup". To achieve the desired functionality and depending on your role filters you may need to set up role specific metadata host listings. This would mean instantiating the default summary page with additional filters on the "| metadata" commands for each role.

For instance:
| metadata type=hosts | search host=A OR host=B

0 Karma

alexiri
Communicator

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work:

[| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format]

username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this:

( ( ( contact="jimbo" OR contact="jones" ) ) )

which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction?

0 Karma

hazekamp
Builder

Yes, summary page for each role. You can make less "Hard-coded" by setting up macros or a saved search that you can change w/o having to go back to the view XML each time.

0 Karma

afaraino
Explorer

Do you mean a summary page for each role? Hard-coded?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...