Security

Permissions to view knowledge objects but restrict search

Tim_1
Path Finder

Hi all,

Using Splunk enterprise 6.4.2, is it possible to allow users to view a dashboard that runs some savedsearches and also loads results from a savedsearch, but also restrict them from being able to run/write their own search queries.

If it is possible, what capabilities allow for this.

Thanks

0 Karma

nileena
Path Finder

I would suggesting hiding the search view, instead of removing search capability.
Go to Settings>User interface>Views.

Here, "search" is a view and you can change the permissions of this view and remove access to certain roles.

This way, the searches on dashboards and reports continue to run for the users belonging to these roles, but they wouldn't be able to access the search page to run ad hoc searches.

somesoni2
SplunkTrust
SplunkTrust

Search capability is required for running dashboard searches and saved searches, so users will need search capability, allowing them to run adhoc searches.

0 Karma

Tim_1
Path Finder

@somesoni2, thanks, would it be possible to hide the search view from specific users then?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...