A similar question as in Is there a way to prevent users from saving knowledge objects in the Searching and Reporting app
We want to avoid all users except the admin ones from creating any knowledge objects within the Search app, including private ones.
Is it possible?
Here are some ideas:
1: Remove the capability
to save knowledge objects
entirely. When users request this capability, force them to complete your training course WHICH INCLUDES THIS PROHIBITION. Give those who pass the class/test the capability.
2: Create a cron
job on the search head that removes/moves everything in the local
directory every night. Users can save KOs, but they will not live very long.
Interesting thing @woodcock.
-- 1: Remove the capability
to save knowledge objects
entirely.
Where exactly?
-- 2: it's pretty sad that we need to do something like this in the back-end...
Go to Settings
-> Access controls
-> Users
and Roles
.
Meaning, preventing them from creating any knowledge objects in any app? that's a bit much...
@woodcock, option #1 seems a bit excessive and option #2 hard to implement.
Option #2 is trivial; cron this (WITH MUCH TESTING AND MODIFIED FOR EXCEPTIONS):
find /opt/splunk/etc/apps/*/local/*.conf -delete
Users can save in their personal space because that writes to /opt/splunk/etc/users/...
.
Re Option #1: I'm not seeing a discrete capability that maps to the ability to create "private" knowledge objects. If there is one, what capability is it?
PS Thanks for option #2. We may use that. I'd still rather prevent the ability to create / clone stuff (as private) for accounts where all we want them to do is to view dashboards.