How do I make a view that includes the "View Results" links only for certain roles?

[araitz]

I have created a view with several table and chart modules. I want users in the 'admin' role to be able to drill down from these modules via "View Results" (aka ViewRedirectorLink module). However, I don't want "View Results" to be available for users that are not in the 'admin' role. How can I accomplish this in Splunk 4.1.3?

[kmattern]

There is another way that I use. do the following with the ViewRedirectorLink.html file. Comment out the line with "View results" and replace it with

 <a href="#">${module.get("label", _("> ."))}</a>

The file should then look like this:

<%page args="module"/>

<!-- <a href="#">${module.get("label", _("View results")) | h}</a> -->
<a href="#">${module.get("label", _(" ."))}</a>

</fieldset>

The result is a barely noticible dot, or period, that is still clickable if you know it is there. That allows me and my admins to access the search itself while the end user isn't aware that it exists.

[sideview · Accepted solution]

Your two best options are:

1) Convert to advanced XML if you're not in the advanced XML already, and just remove the ‘ViewRedirectorLink’ modules entirely.

2) Use application.css to apply a display:none style to the ViewRedirectorLink modules so that they are stricken from the page and are unclickable, banished, kaput, etc..

If you need to get fancier and have some users see a 'View results' link and some other users to NOT see the same link, then there's no way to get #1 to work for you.

However there's still a way forward in that case with #1. It's just that you have to actually create two different views. The only difference between the two views will be that one has ViewRedirectorLink modules, and the other doesnt. Give the views different filenames but you can give them the same 'label'. Then you set the permissions on one so that certain roles can see it, and other roles cannot, and you set the reverse permissions on the other view.

End result to the users is that users in certain roles have the links.

[araitz]

Thanks Nick!

Lowell, if keeping the drill-down data completely inaccessible from the user is of concern, it would be wiser (and easier) to use summary indexing and only expose the summarized data to the role in question.

[Lowell]

The user can still get to the search from the "Jobs" link right? (And even if that was disabled, you could still monitor the browsers activity and pickup the job id from the URLs the browser is hitting and then fetch the job from there.) So I'm assuming this is just a convenience / "perceived security" thing, it doesn't actually stop the users from getting to the data right?