Dashboards & Visualizations

Cached dashboards and permissions

HeinzWaescher
Motivator

Hi,

I've changed the permissions of a dashboard, to allow user A to have a look at it. The included reports are scheduled every night.

When user A opens the dashboard no cache is used and all reports start searching from scratch. Is there a way to avoid this? It's a bit uncomfortable to wait for the next schedule or rerun the cache manually, everytime I change read permissions for new users.

BR

Heinz

0 Karma

ecambra_splunk
Splunk Employee
Splunk Employee

Are the permissions for the searches/reports powering the dashboard also allowing user A to view them? If the user does not have permissions to also view the report it may not allow access to the saved/scheduled search.

Additionally, What is the alert expiration for the scheduled search/report? This could be causing the report to expire before the next days report has run. You can also check the Activity > Jobs to insure the search is running and caching results.

0 Karma

HeinzWaescher
Motivator

Hey, thanks for your answer.
Yes, the user is allowed to view them. And everything works fine, when the cache is refreshed once again after setting the permissions for this user.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...