Reporting

How to configure a role to disable the capability to create saved searches?

jmallorquin
Builder

Hi,

We have configured a role to disable the capability to create saved searches, adding only the capabilities:
-change_own_password
-export_results_is_visible
-rest_properties_get
-search

But I have found that users with this role still can create saved searches.

Any advice?

Regards,

0 Karma

inventsekar
SplunkTrust
SplunkTrust

maybe, try disabling these capabilities for this role..
schedule_search Schedule saved searches, create and update alerts, and review triggered alert information.
schedule_rtsearch Schedule real-time saved searches. In order for a user to use this capability their role must also have the schedule_search capability.

0 Karma

jmallorquin
Builder

Hi inventsekar,

Did you see any of the capabilities that you said in the list that I provide of the role that i configure?

Regards,

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...