- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- One dashboard, multiple restricted views
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to create a single dashboard that will give users a view into the THEIR data depending on their permissions. For instance department A has an IP range of 192.168.1.0/24 and department B has an IP range of 192.168.2.0/24...etc. I would like to create one dashboard for user web traffic, threats, violations etc but then when the user from Department A logs into the dashboard they can ONLY see reports based on their IP range.
I may have an answer to this with building different apps for different departments but it doesn't seem like the most efficient way to achieve the goals, in fact, it seems like an administrative nightmare for me with 60+ departments.
Can you offer some guidance?
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I may have the answer to my question. aholzer, you were right it does work - the issue I was having is that I set those dashboards to run every night at 3am to minimize the time it takes for them to show results and to lighten the load on the CPU.
In order for the dashboard to re-render for the restricted role, it must run at dashboard load.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I may have the answer to my question. aholzer, you were right it does work - the issue I was having is that I set those dashboards to run every night at 3am to minimize the time it takes for them to show results and to lighten the load on the CPU.
In order for the dashboard to re-render for the restricted role, it must run at dashboard load.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was suggested to me that I may use "Restrict search terms" on the role however that doesn't seem to work.
I would show you images but I guess I don't have the karma for it...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried using the "Restrict search terms" in the roles that you assign the different departments?
This way you can write a single dashboard that collects data for both, but since the Role Filter would be applied on top of that, the user should only view those results relevant to their department.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could consider storing the messages for different departments in separate Indexes. You can then set the roles to have access only to their departments index. This would be slightly more involved, but in the long run you would save time and effort because you woulnd't have to duplicate dashboards.
I know for a fact that the separate index method works, because I have applied it on several occassions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, I did try that and it doesn't seem to limit the results. If I run a new search from the role with Restricted search terms, then it has the desired affect, just not in the dashboard 😞
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
