All Apps and Add-ons

F5 Security: Within the "All Indexed data" section, how do I remove the option have it follow the role permissions?

joeld
New Member

I have the Splunk App installed "F5 Security" which has a section on the home-screen labeled "All indexed data". Within this section it is listed All: Sources, Sourcetypes and Hosts. My user Roll is restricted to index and policy and inherits permissions for the user.

Is there a way to restrict data based on the Role of the user or just stop list the data all together?
Is there a way to just remove this whole "All Indexed data" section?

Thank You.
alt text

0 Karma

rewritex
Contributor

Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information.

    <view template="dashboard.html" onunloadCancelJobs="True">
      <label>Indexed Data</label>
      <module name="AccountBar" layoutPanel="navigationHeader"/>
      <module name="AppBar" layoutPanel="navigationHeader"/>
      <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
      </module>
      <module name="TitleBar" layoutPanel="navigationHeader">
        <param name="showActionsMenu">True</param>
      </module>  

      <module name="SearchBar" layoutPanel="mainSearchControls">
        <param name="useAssistant">true</param>
        <param name="useTypeahead">true</param>
        <module name="TimeRangePicker">
          <param name="selected">Last 24 hours</param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>


>       **<module name="StaticContentSample"
> layoutPanel="panel_row2_col1"
> group="All indexed data"
> autoRun="True">
>         <param name="text">This lists all of the data you have loaded into
> your default indexes over all
> time.</param>
>         <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1">
>           <param name="label">Sources</param>
>           <module name="HiddenSearch">
>             <param name="search">| metadata type=sources | sort
> -totalCount</param>
>             <module name="Paginator">
>               <param name="count">20</param>
>               <param name="entityName">results</param>
>               <param name="maxPages">10</param>
>               <module name="LinkList">
>                 <param name="initialSortDir">desc</param>
>                 <param name="labelFieldSearch">*</param>
>                 <param name="valueField">totalCount</param>
>                 <param name="labelField">source</param>
>                 <param name="labelFieldTarget">flashtimeline</param>
>                 <param name="initialSort">totalCount</param>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2">
>             <param name="label">Sourcetypes</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=sourcetypes | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">sourcetype</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module>
>           <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3">
>             <param name="label">Hosts</param>
>             <module name="HiddenSearch">
>               <param name="search">| metadata type=hosts | sort 300
> -totalCount</param>
>               <module name="Paginator">
>                 <param name="count">20</param>
>                 <param name="entityName">results</param>
>                 <param name="maxPages">10</param>
>                 <module name="LinkList">
>                   <param name="initialSortDir">desc</param>
>                   <param name="labelFieldSearch">*</param>
>                   <param name="valueField">totalCount</param>
>                   <param name="labelField">host</param>
>                   <param name="labelFieldTarget">flashtimeline</param>
>                   <param name="initialSort">totalCount</param>
>                 </module>
>               </module>
>             </module>
>           </module> 
>         </module>
>       </module>**

    </view>
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...