All Apps and Add-ons

F5 Security: Within the "All Indexed data" section, how do I remove the option have it follow the role permissions?

joeld
New Member

I have the Splunk App installed "F5 Security" which has a section on the home-screen labeled "All indexed data". Within this section it is listed All: Sources, Sourcetypes and Hosts. My user Roll is restricted to index and policy and inherits permissions for the user.

Is there a way to restrict data based on the Role of the user or just stop list the data all together?
Is there a way to just remove this whole "All Indexed data" section?

Thank You.
alt text

0 Karma

rewritex
Contributor

Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information.

    <view template="dashboard.html" onunloadCancelJobs="True">
      <label>Indexed Data</label>
      <module name="AccountBar" layoutPanel="navigationHeader"/>
      <module name="AppBar" layoutPanel="navigationHeader"/>
      <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
      </module>
      <module name="TitleBar" layoutPanel="navigationHeader">
        <param name="showActionsMenu">True</param>
      </module>  

      <module name="SearchBar" layoutPanel="mainSearchControls">
        <param name="useAssistant">true</param>
        <param name="useTypeahead">true</param>
        <module name="TimeRangePicker">
          <param name="selected">Last 24 hours</param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>


>       **<module name="StaticContentSample"
> layoutPanel="panel_row2_col1"
> group="All indexed data"
> autoRun="True">
>         <param name="text">This lists all of the data you have loaded into
> your default indexes over all
> time.</param>
>         <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1">
>           <param name="label">Sources</param>
>           <module name="HiddenSearch">
>             <param name="search">| metadata type=sources | sort
> -totalCount</param>
>             <module name="Paginator">
>               <param name="count">20</param>
>               <param name="entityName">results</param>
>               <param name="maxPages">10</param>
>               <module name="LinkList">
>                 <param name="initialSortDir">desc</param>
>                 <param name="labelFieldSearch">*</param>
>                 <param name="valueField">totalCount</param>
>                 <param name="labelField">source</param>
>                 <param name="labelFieldTarget">flashtimeline</param>
>                 <param name="initialSort">totalCount</param>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2">
>             <param name="label">Sourcetypes</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=sourcetypes | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">sourcetype</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3">
>             <param name="label">Hosts</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=hosts | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">host</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module> 
>         </module>
>       </module>**

    </view>
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...