Splunk Search

Use role's "restrict search terms" in complex search

afaraino
Explorer

Hi everyone,
I'm having different roles with different restrict search terms. However, in my dashboards, a drop down list is populated with this search :
| metadata type=hosts

So my user can choose a host that he can't use (dashboard remains empty). Is there a variable I can insert in my populatingSearch?

Thanks for your help

Tags (2)
0 Karma

hazekamp
Builder

Search filters DO NOT work with generating search commands such as "| metadata" or "| inputlookup". To achieve the desired functionality and depending on your role filters you may need to set up role specific metadata host listings. This would mean instantiating the default summary page with additional filters on the "| metadata" commands for each role.

For instance:
| metadata type=hosts | search host=A OR host=B

0 Karma

alexiri
Communicator

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work:

[| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format]

username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this:

( ( ( contact="jimbo" OR contact="jones" ) ) )

which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction?

0 Karma

hazekamp
Builder

Yes, summary page for each role. You can make less "Hard-coded" by setting up macros or a saved search that you can change w/o having to go back to the view XML each time.

0 Karma

afaraino
Explorer

Do you mean a summary page for each role? Hard-coded?

0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...