topic Re: Disable external UI URIs in Dashboards & Visualizations

Disable external UI URIs

deyeo — Fri, 15 Apr 2011 02:10:21 GMT

I would like to disable external UI URIs. yes, i'm paranoid about security.

I saw in the ../splunk/etc/system/default/web.conf file that this can possibility be done.

external UI URIs

serviceFormPostURL = http://headlamp.splunk.com/event/add

userRegistrationURL = https://www.splunk.com/index.php/pre_reg?destination=prod_reg

userEntTrialRegistrationURL = https://www.splunk.com/index.php/sign_up?destination=prod_reg

userResendRegistrationURL =https://www.splunk.com/index.php/pre_reg?destination=prod_resend

updateCheckerBaseURL = https://quickdraw.splunk.com/js/

docsCheckerBaseURL=https://quickdraw.splunk.com/help

Are there any impact if they are disabled? How do i disable them? Directly comment these lines in the default web.conf?

Re: Disable external UI URIs

sideview — Fri, 15 Apr 2011 02:44:12 GMT

They can all be set to null, which will turn off everything that might hit splunk.com

But never edit the files in the default directory. You should, and always can, edit the same files, stanzas and keys, by making the same changes over in the 'local' directory.

in $SPLUNK_HOME/etc/system/local/web.conf,

add a [settings] stanza if you dont have one already, and then under [settings], add the following:

serviceFormPostURL = 
userRegistrationURL = 
userEntTrialRegistrationURL = 
userResendRegistrationURL = 
updateCheckerBaseURL = 
docsCheckerBaseURL=

It looks weird but that will null them all out.

Re: Disable external UI URIs

deyeo — Fri, 15 Apr 2011 03:38:50 GMT

how about the $SPLUNK_HOME/etc/system/default/server.conf file which contains the following:

In 4.1.x,
[applicationsManagement]
url = http://www.splunkbase.com/api/apps
loginUrl = http://www.splunkbase.com/api/account:login/

can they be nulled without any negative impact to Splunk?

Re: Disable external UI URIs

araitz — Fri, 15 Apr 2011 04:40:59 GMT

Yes, that should be fine, though if anyone browses to the parts of Splunk that attempt to connect to Splunkbase, they might not have the experience that they are expecting.