Hi there.Lets see if someone can help me with this. We have this requirement:
We have several saved searches and reports that need to be shown to a number of users, but with a slight change for different user groups. Lets say that the "change" is a value for a field, for instance Field1=$userField$ (maybe I could build a python command if that change isn't that simple, but that's not my question). What if I don't want to create a different app or saved search for each group, but get that userField value when the user logs. Are you following me?
One idea we had was to use query string values, we will publish splunk's url for each group like this: splunk.....?userField=value, and then use that value for every search. Maybe using a ServerSideInclude I can process that url and extract the value I need. The thing is that I can't find a way to keep this sort of Session variable, because I need it for every search the user use.
Is this possible? or is it maybe some easier way?
OK. I haven't been able to do what I wanted. It seems there's be no way to store a value during the whole user session. The solution we've arrived so far is to embed a specially created view in some external web site, and call a saved search sending macro parameters. I mean, my saved search is something like:
and I embed the report on some html page of my own, like this:
And this shows me the filtered report I wanted. This way I can get the FilterValue from the page, using JQuery or something else, thus limiting the amount of information showed to this particular user.
Can anyone think of a simpler solution?
answered 29 Jul '10, 14:46