Hello.
I created a dashboard using some of the data from the Splunk App for Unix. Its in the default index called "os."
I notice that only the admin user of splunk can query info out of that index. Is there something I need to do to allow other users to do that? The issue I have is when I shared the dashboards, nobody can see the data within the panels except the admin user.
You can give users read permission to an index by editing their role (Settings -> Authentication -> Roles). There's two settings, indexes searched by default (what happens when you don't specify index=foo
) and indexes searchable.
Out of the box all users can search all non-internal indexes, so they should already be able to search with index=os
- if not, add that index to their indexes searchable setting.