All Apps and Add-ons

F5 Security: Within the "All Indexed data" section, how do I remove the option have it follow the role permissions?

joeld
New Member

I have the Splunk App installed "F5 Security" which has a section on the home-screen labeled "All indexed data". Within this section it is listed All: Sources, Sourcetypes and Hosts. My user Roll is restricted to index and policy and inherits permissions for the user.

Is there a way to restrict data based on the Role of the user or just stop list the data all together?
Is there a way to just remove this whole "All Indexed data" section?

Thank You.
alt text

0 Karma

rewritex
Contributor

Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information.

    <view template="dashboard.html" onunloadCancelJobs="True">
      <label>Indexed Data</label>
      <module name="AccountBar" layoutPanel="navigationHeader"/>
      <module name="AppBar" layoutPanel="navigationHeader"/>
      <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
      </module>
      <module name="TitleBar" layoutPanel="navigationHeader">
        <param name="showActionsMenu">True</param>
      </module>  

      <module name="SearchBar" layoutPanel="mainSearchControls">
        <param name="useAssistant">true</param>
        <param name="useTypeahead">true</param>
        <module name="TimeRangePicker">
          <param name="selected">Last 24 hours</param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>


>       **<module name="StaticContentSample"
> layoutPanel="panel_row2_col1"
> group="All indexed data"
> autoRun="True">
>         <param name="text">This lists all of the data you have loaded into
> your default indexes over all
> time.</param>
>         <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1">
>           <param name="label">Sources</param>
>           <module name="HiddenSearch">
>             <param name="search">| metadata type=sources | sort
> -totalCount</param>
>             <module name="Paginator">
>               <param name="count">20</param>
>               <param name="entityName">results</param>
>               <param name="maxPages">10</param>
>               <module name="LinkList">
>                 <param name="initialSortDir">desc</param>
>                 <param name="labelFieldSearch">*</param>
>                 <param name="valueField">totalCount</param>
>                 <param name="labelField">source</param>
>                 <param name="labelFieldTarget">flashtimeline</param>
>                 <param name="initialSort">totalCount</param>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2">
>             <param name="label">Sourcetypes</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=sourcetypes | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">sourcetype</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3">
>             <param name="label">Hosts</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=hosts | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">host</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module> 
>         </module>
>       </module>**

    </view>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...