I have the Splunk App installed "F5 Security" which has a section on the home-screen labeled "All indexed data". Within this section it is listed All: Sources, Sourcetypes and Hosts. My user Roll is restricted to index and policy and inherits permissions for the user.
Is there a way to restrict data based on the Role of the user or just stop list the data all together?
Is there a way to just remove this whole "All Indexed data" section?
Thank You.
Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information.
<view template="dashboard.html" onunloadCancelJobs="True">
<label>Indexed Data</label>
<module name="AccountBar" layoutPanel="navigationHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="navigationHeader">
<param name="showActionsMenu">True</param>
</module>
<module name="SearchBar" layoutPanel="mainSearchControls">
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<module name="TimeRangePicker">
<param name="selected">Last 24 hours</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
> **<module name="StaticContentSample"
> layoutPanel="panel_row2_col1"
> group="All indexed data"
> autoRun="True">
> <param name="text">This lists all of the data you have loaded into
> your default indexes over all
> time.</param>
> <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1">
> <param name="label">Sources</param>
> <module name="HiddenSearch">
> <param name="search">| metadata type=sources | sort
> -totalCount</param>
> <module name="Paginator">
> <param name="count">20</param>
> <param name="entityName">results</param>
> <param name="maxPages">10</param>
> <module name="LinkList">
> <param name="initialSortDir">desc</param>
> <param name="labelFieldSearch">*</param>
> <param name="valueField">totalCount</param>
> <param name="labelField">source</param>
> <param name="labelFieldTarget">flashtimeline</param>
> <param name="initialSort">totalCount</param>
> </module>
> </module>
> </module>
> <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2">
> <param name="label">Sourcetypes</param>
> <module name="HiddenSearch">
> <param name="search">| metadata type=sourcetypes | sort 300
> -totalCount</param>
> <module name="Paginator">
> <param name="count">20</param>
> <param name="entityName">results</param>
> <param name="maxPages">10</param>
> <module name="LinkList">
> <param name="initialSortDir">desc</param>
> <param name="labelFieldSearch">*</param>
> <param name="valueField">totalCount</param>
> <param name="labelField">sourcetype</param>
> <param name="labelFieldTarget">flashtimeline</param>
> <param name="initialSort">totalCount</param>
> </module>
> </module>
> </module>
> </module>
> <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3">
> <param name="label">Hosts</param>
> <module name="HiddenSearch">
> <param name="search">| metadata type=hosts | sort 300
> -totalCount</param>
> <module name="Paginator">
> <param name="count">20</param>
> <param name="entityName">results</param>
> <param name="maxPages">10</param>
> <module name="LinkList">
> <param name="initialSortDir">desc</param>
> <param name="labelFieldSearch">*</param>
> <param name="valueField">totalCount</param>
> <param name="labelField">host</param>
> <param name="labelFieldTarget">flashtimeline</param>
> <param name="initialSort">totalCount</param>
> </module>
> </module>
> </module>
> </module>
> </module>
> </module>**
</view>