Splunk Search

How can we prevent users from creating knowledge objects within the Search app?

ddrillic
Ultra Champion

A similar question as in Is there a way to prevent users from saving knowledge objects in the Searching and Reporting app

We want to avoid all users except the admin ones from creating any knowledge objects within the Search app, including private ones.
Is it possible?

0 Karma

woodcock
Esteemed Legend

Here are some ideas:

1: Remove the capability to save knowledge objects entirely. When users request this capability, force them to complete your training course WHICH INCLUDES THIS PROHIBITION. Give those who pass the class/test the capability.

2: Create a cron job on the search head that removes/moves everything in the local directory every night. Users can save KOs, but they will not live very long.

ddrillic
Ultra Champion

Interesting thing @woodcock.

-- 1: Remove the capability to save knowledge objects entirely.
Where exactly?

-- 2: it's pretty sad that we need to do something like this in the back-end...

0 Karma

woodcock
Esteemed Legend

Go to Settings -> Access controls -> Users and Roles.

0 Karma

ddrillic
Ultra Champion

Meaning, preventing them from creating any knowledge objects in any app? that's a bit much...

0 Karma

ddrillic
Ultra Champion

@woodcock, option #1 seems a bit excessive and option #2 hard to implement.

0 Karma

woodcock
Esteemed Legend

Option #2 is trivial; cron this (WITH MUCH TESTING AND MODIFIED FOR EXCEPTIONS):

find /opt/splunk/etc/apps/*/local/*.conf -delete

Users can save in their personal space because that writes to /opt/splunk/etc/users/....

0 Karma

wryanthomas
Contributor

Re Option #1: I'm not seeing a discrete capability that maps to the ability to create "private" knowledge objects. If there is one, what capability is it?

PS Thanks for option #2. We may use that. I'd still rather prevent the ability to create / clone stuff (as private) for accounts where all we want them to do is to view dashboards.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...