Security

Create new App for new Role

hbazan
Path Finder

Hi there. I need to create a new App, and make it available to new users. Those new users should be able to access only this new App.

So I created a new role, cloned from User, and granted access to the new app and some of my views and saved searches. I've also allowed access to flashtimeline and my eventtypes.

In this new app I have a dashboard with links to my saved searches. The dashboard works fine, but with the links to saved searches, the new users get a 404 error: "404 Not Found

The following requested saved search is unknown: "My Search". As a result, Splunk is unable to redirect to a view."

Also, if I want to access directly to flashtimeline (http://splunk.../app/NewApp/flashtimeline), I get: "404 Not Found

Splunk cannot find the "flashtimeline" view."

What am I doing wrong?

0 Karma

Zambonilli
Explorer

This happens if the user doesn't have Read access to the Search application. I've started from a fresh install of the beta 4 version of and if you create a user in the Power user role and remove read permissions from the Search app for the Power role you will get this message.

0 Karma

Zambonilli
Explorer

We just added everyone to have read access to the Search app and then hid the Search app.

0 Karma

Ant1D
Motivator

How do you set a new role to have read access to the Search app

0 Karma

hbazan
Path Finder

I'm running Splunk 4.1.3. We've recently upadated from 4.0.6. My navigation is default, local to my app (readable for everyone). The dashboard is also defined in my app and readable for everyone. The flashtimeline is defined as Global, readable for everyone. I'm trying with one specific search, that is readable for User, Power, and MyNewRole.

0 Karma

Lowell
Super Champion

What version of splunk are you running? Are you sure that "flashtimeline" is accessible to your new role? (It should be by default). Have you setup any navigation for your new app?

0 Karma

erydberg
Splunk Employee
Splunk Employee

Have you checked in the manager that the searches are not owned by the admin, but by the app? That could cause these error messages. Go to Manager > Searches and reports and check that the owner is the app and not another user.

Edit: What I meant was to check that admin wasn't the owner of the saved searches and that that overrides the app permissions. I'm sorry about the confusion, apps can't own searches.

0 Karma

hbazan
Path Finder

Yes, the roles are ok. I suspect that it's not the search the problem, but some view or command (I think so because a search is opened in the flashtimeline).

0 Karma

erydberg
Splunk Employee
Splunk Employee

Did you check the permissions link in the manager > searches and reports? There you can set with roles are able to read the saved search.

0 Karma

hbazan
Path Finder

No, that's OK.
The thing is (i forgot to mention on my post) if I grant the new user the "User" role, everything works fine.
It's like in some point there's a lack of a permission. Maybe some command?

0 Karma

Lowell
Super Champion

What do you mean my owned by the app? Do you mean application-level sharing, or given read access to the role associated with the app? As far as I know, there is no concept of an "app" owning anything? (Obviously searches and other objects have to live somewhere, but be defined in an app is not the same as being the "owner" of the apps objects)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...