topic Re: How can we prevent users from creating knowledge objects within the Search app? in Splunk Search

How can we prevent users from creating knowledge objects within the Search app?

ddrillic — Wed, 05 Jun 2019 15:10:43 GMT

We want to avoid all users except the admin ones from creating any knowledge objects within the Search app, including private ones.
Is it possible?

Re: How can we prevent users from creating knowledge objects within the Search app?

woodcock — Wed, 05 Jun 2019 15:27:07 GMT

Here are some ideas:

1: Remove the capability to save knowledge objects entirely. When users request this capability, force them to complete your training course WHICH INCLUDES THIS PROHIBITION. Give those who pass the class/test the capability.

2: Create a cron job on the search head that removes/moves everything in the local directory every night. Users can save KOs, but they will not live very long.

Re: How can we prevent users from creating knowledge objects within the Search app?

ddrillic — Wed, 05 Jun 2019 15:32:26 GMT

Interesting thing @woodcock.

-- 1: Remove the capability to save knowledge objects entirely.
Where exactly?

-- 2: it's pretty sad that we need to do something like this in the back-end...

Re: How can we prevent users from creating knowledge objects within the Search app?

woodcock — Wed, 05 Jun 2019 15:34:48 GMT

Go to Settings -> Access controls -> Users and Roles.

Re: How can we prevent users from creating knowledge objects within the Search app?

ddrillic — Wed, 05 Jun 2019 15:44:23 GMT

Meaning, preventing them from creating any knowledge objects in any app? that's a bit much...

Re: How can we prevent users from creating knowledge objects within the Search app?

ddrillic — Thu, 13 Jun 2019 21:02:53 GMT

@woodcock, option #1 seems a bit excessive and option #2 hard to implement.

Re: How can we prevent users from creating knowledge objects within the Search app?

woodcock — Thu, 13 Jun 2019 21:27:30 GMT

Option #2 is trivial; cron this (WITH MUCH TESTING AND MODIFIED FOR EXCEPTIONS):

find /opt/splunk/etc/apps/*/local/*.conf -delete

Users can save in their personal space because that writes to /opt/splunk/etc/users/....

Re: How can we prevent users from creating knowledge objects within the Search app?

wryanthomas — Fri, 17 Apr 2020 17:46:40 GMT

Re Option #1: I'm not seeing a discrete capability that maps to the ability to create "private" knowledge objects. If there is one, what capability is it?

PS Thanks for option #2. We may use that. I'd still rather prevent the ability to create / clone stuff (as private) for accounts where all we want them to do is to view dashboards.