Add support for private dashboards with sharing level filter and display

Co-authored-by: devinslick <[email protected]>

Author: Copilot

README.md

@@ -116,19 +116,22 @@ The `caca_metrics` index should be created automatically. Verify by running:
 Run the registry update search to populate the dashboard registry:
 
 ```spl
-| rest /services/data/ui/views splunk_server=local count=0 
+| rest /services/data/ui/views splunk_server=local count=0 search="sharing=*"
 | search isDashboard=1 OR isVisible=1 
 | eval dashboard_uri="/app/".eai:acl.app."/".title 
 | eval pretty_name=coalesce(label, title) 
 | eval app=eai:acl.app 
 | eval owner=eai:acl.owner 
+| eval sharing=eai:acl.sharing
 | eval description=coalesce(eai:data, "") 
 | eval status="active" 
-| table dashboard_uri pretty_name app owner description status 
+| table dashboard_uri pretty_name app owner sharing description status 
 | outputlookup dashboard_registry.csv
 ```
 
-This will scan your Splunk environment and populate the `dashboard_registry.csv` lookup with all discovered dashboards.
+This will scan your Splunk environment and populate the `dashboard_registry.csv` lookup with all discovered dashboards, including private dashboards.
+
+**Note on Private Dashboards:** The `search="sharing=*"` parameter ensures that dashboards with all sharing levels (global, app, and user/private) are included in the registry. To see private dashboards owned by other users, the scheduled search must run with appropriate permissions (typically as admin or with the `list_storage_passwords` capability).
 
 **Verify the registry:**
 
@@ -455,17 +458,20 @@ Edit `lookups/dashboard_registry.csv` and set `status=inactive` for specific das
 
 Run the registry update search manually:
 ```spl
-| rest /services/data/ui/views splunk_server=local count=0 
+| rest /services/data/ui/views splunk_server=local count=0 search="sharing=*"
 | search isDashboard=1 OR isVisible=1 
 | eval dashboard_uri="/app/".eai:acl.app."/".title 
 | eval pretty_name=coalesce(label, title) 
 | eval app=eai:acl.app 
 | eval owner=eai:acl.owner 
+| eval sharing=eai:acl.sharing
 | eval status="active" 
-| table dashboard_uri pretty_name app owner status 
+| table dashboard_uri pretty_name app owner sharing status 
 | outputlookup dashboard_registry.csv
 ```
 
+**For Private Dashboards:** If private dashboards still don't appear, ensure the search is running with appropriate permissions. Private dashboards owned by other users require admin privileges or specific capabilities to be discovered via REST API.
+
 Or add it manually to `lookups/dashboard_registry.csv`.
 
 ### Metrics Showing Zero

default/data/ui/views/CACA_ADMIN_README.md

@@ -185,12 +185,19 @@ To use the CACA Admin Dashboard effectively, you need:
 - Verify the dashboard registry is populated: `| inputlookup dashboard_registry`
 - Check that metrics are being collected: `| mstats count WHERE index=caca_metrics`
 - Ensure filters aren't too restrictive (try resetting to defaults)
+- **For private dashboards**: Ensure the "Dashboard Registry - Auto Update" scheduled search runs with appropriate permissions to discover private dashboards owned by other users
 
 ### Filters Not Working
 - Click the "Submit" button after changing filters
 - Check for typos in the name filter (use wildcards: *)
 - Verify app/owner names match exactly what's in the registry
 
+### Private Dashboards Not Appearing
+- Private dashboards require the registry update search to run with admin privileges
+- Verify the search includes `search="sharing=*"` parameter in the REST call
+- Check if the user running the scheduled search has permissions to view other users' private content
+- Manually verify private dashboard exists: `| rest /services/data/ui/views search="sharing=*" | search owner="username" sharing="user"`
+
 ### Links Not Working
 - Ensure you have appropriate permissions to access management pages
 - Some links require admin or power user roles
@@ -205,6 +212,13 @@ To use the CACA Admin Dashboard effectively, you need:
 - `caca_metrics` index
 - Search macro: `get_all_dashboards_summary`
 
+**Private Dashboard Support**:
+- The dashboard registry includes dashboards with all sharing levels: global, app, and user/private
+- The registry update search uses `search="sharing=*"` parameter to discover private dashboards
+- Viewing private dashboards owned by other users requires appropriate permissions
+- The scheduled search should run with admin privileges to capture all private dashboards across users
+- The `sharing` field in the registry indicates the sharing level of each dashboard
+
 **Performance Considerations**:
 - Initial load may take a few seconds if you have many dashboards
 - Filters are applied on submit to improve performance

default/data/ui/views/caca_admin.xml

@@ -43,6 +43,19 @@
       <delimiter> OR </delimiter>
     </input>
 
+    <input type="multiselect" token="sharing_filter">
+      <label>Filter by Sharing Level</label>
+      <choice value="*">All Sharing Levels</choice>
+      <choice value="global">🌐 Global</choice>
+      <choice value="app">📦 App</choice>
+      <choice value="user">🔒 Private</choice>
+      <default>*</default>
+      <initialValue>*</initialValue>
+      <valuePrefix>sharing="</valuePrefix>
+      <valueSuffix>"</valueSuffix>
+      <delimiter> OR </delimiter>
+    </input>
+    
     <input type="multiselect" token="health_filter">
       <label>Filter by Health Status</label>
       <choice value="*">All Status</choice>
@@ -85,8 +98,8 @@
       <single>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
-| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $health_filter$
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
+| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $sharing_filter$ $health_filter$
 | eval perf_category=case(
     avg_load_time_7d == 0, "unknown",
     avg_load_time_7d &lt; 1000, "fast",
@@ -110,8 +123,8 @@
       <single>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
-| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $health_filter$
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
+| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $sharing_filter$ $health_filter$
 | eval perf_category=case(
     avg_load_time_7d == 0, "unknown",
     avg_load_time_7d &lt; 1000, "fast",
@@ -136,8 +149,8 @@
       <single>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
-| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $health_filter$
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
+| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $sharing_filter$ $health_filter$
 | eval perf_category=case(
     avg_load_time_7d == 0, "unknown",
     avg_load_time_7d &lt; 1000, "fast",
@@ -163,8 +176,8 @@
       <single>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
-| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $health_filter$
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
+| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $sharing_filter$ $health_filter$
 | eval perf_category=case(
     avg_load_time_7d == 0, "unknown",
     avg_load_time_7d &lt; 1000, "fast",
@@ -214,8 +227,8 @@
       <table>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
-| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $health_filter$
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
+| search pretty_name="$name_filter$" $app_filter$ $owner_filter$ $sharing_filter$ $health_filter$
 | eval perf_category=case(
     avg_load_time_7d == 0, "unknown",
     avg_load_time_7d &lt; 1000, "fast",
@@ -236,10 +249,15 @@
     health_status=="critical", "✗ Critical",
     health_status=="stale", "☾ Stale",
     1=1, health_status)
+| eval sharing_display=case(
+    sharing=="global", "🌐 Global",
+    sharing=="app", "📦 App",
+    sharing=="user", "🔒 Private",
+    1=1, coalesce(sharing, "-"))
 | eval dashboard_link=dashboard_uri
 | eval title_from_uri=mvindex(split(dashboard_uri, "/"), -1)
-| table pretty_name app owner views_7d edits_7d errors_7d avg_load_time_7d perf_rating health_badge dashboard_link title_from_uri
-| rename pretty_name as "Dashboard Name", app as "App", owner as "Owner", views_7d as "Views (7d)", edits_7d as "Edits (7d)", errors_7d as "Errors (7d)", avg_load_time_7d as "Avg Load (ms)", perf_rating as "Performance", health_badge as "Health", dashboard_link as "Dashboard URI", title_from_uri as "Title"
+| table pretty_name app owner sharing_display views_7d edits_7d errors_7d avg_load_time_7d perf_rating health_badge dashboard_link title_from_uri
+| rename pretty_name as "Dashboard Name", app as "App", owner as "Owner", sharing_display as "Sharing", views_7d as "Views (7d)", edits_7d as "Edits (7d)", errors_7d as "Errors (7d)", avg_load_time_7d as "Avg Load (ms)", perf_rating as "Performance", health_badge as "Health", dashboard_link as "Dashboard URI", title_from_uri as "Title"
 | sort - "Views (7d)"</query>
           <earliest>$time_range.earliest$</earliest>
           <latest>$time_range.latest$</latest>
@@ -255,6 +273,9 @@
         <format type="color" field="Performance">
           <colorPalette type="map">{"⚡ Fast":#53A051,"✓ Good":#0877a6,"⚠ Slow":#F8BE34,"✗ Very Slow":#DC4E41,"-":#708794}</colorPalette>
         </format>
+        <format type="color" field="Sharing">
+          <colorPalette type="map">{"🌐 Global":#0877a6,"📦 App":#53A051,"🔒 Private":#F8BE34,"-":#708794}</colorPalette>
+        </format>
         <format type="number" field="Views (7d)">
           <option name="precision">0</option>
         </format>
@@ -353,7 +374,7 @@
       <table>
         <search>
           <query>`get_all_dashboards_summary`
-| lookup dashboard_registry pretty_name OUTPUT owner description dashboard_uri
+| lookup dashboard_registry pretty_name OUTPUT owner sharing description dashboard_uri
 | eval avg_load_time_7d=round(avg_load_time_7d, 0)
 | eval recommendation=case(
     health_status=="critical" AND avg_load_time_7d &gt; 5000, "URGENT: Fix errors AND optimize performance",

default/savedsearches.conf

@@ -105,17 +105,18 @@ description = Automatically updates dashboard registry via REST API, respecting
 dispatch.earliest_time = -5m
 dispatch.latest_time = now
 enableSched = 0
-search = | rest /services/data/ui/views splunk_server=local count=0 \
+search = | rest /services/data/ui/views splunk_server=local count=0 search="sharing=*" \
 | search isDashboard=1 OR isVisible=1 \
 | eval dashboard_uri="/app/".eai:acl.app."/".title \
 | eval pretty_name=coalesce(label, title) \
 | eval app=eai:acl.app \
 | eval owner=eai:acl.owner \
+| eval sharing=eai:acl.sharing \
 | eval description=coalesce(eai:data, "") \
 | eval status="active" \
 | lookup app_filter app OUTPUT include \
 | where isnull(include) OR include="true" OR include="1" OR include="yes" \
 | fields - include \
-| table dashboard_uri pretty_name app owner description status \
+| table dashboard_uri pretty_name app owner sharing description status \
 | outputlookup dashboard_registry.csv
 schedule_priority = low

lookups/dashboard_registry.csv

@@ -1 +1 @@
-dashboard_uri,pretty_name,app,owner,description,status
+dashboard_uri,pretty_name,app,owner,sharing,description,status