How to Restrict Splunk User Access to only one dashboard in search & reporting?

[katzr]

I know that you if you want a user to only view one dashboard- you can create another app and assign that user's role to that app. Is there any way to restrict a user to view only one dashboard in the generic search & reporting app that multiple users have access to?

I know that you can restrict a user to only search on one index- does that in turn restrict a user to only view dashboards that contain that index? For example: user A can only search on index=example, so if that user tries to view a dashboard that pulls from index=example2- can user A see this dashboard?

Thank you in advance for the help!

[gcusello]

Hi, katzr,
it's not a good idea to use Search and Reporting App, it's better to create Apps for the users.

Anyway, to give access to a dashboard only to one user you could:

• create a new role,
• assign that role to the user
• give grants on that dashboard only to that role; in this way only the new role and Admin can access the dashboard .

It's different for Indexes, because if you have a dedicated index for your dashboard, you can share it only with the new role, but at the same time, you have to disable access to this index to all the other roles.

Bye.
Giuseppe

[Jon_Webster]

Is there any way to restrict a user to view only one dashboard in the generic search & reporting app that multiple users have access to?
No. The way this is usually addressed is to create an App with the desired set of dashboards for a Role, and if generic search is required then that page is included in the App.

Can a user be restricted to view dashboards that contain specific indices?
No. Indices are not coupled with Apps. Similar to the first example, this is usually addressed by creating Apps for the Role that include indices appropriate to the Role, even if it may mean creating multiple similar Apps by Role.