https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301332#M90730 <P>I use Splunk as an admin and most of my users are power users. Following a syntactically valid search, a list of matching events is available to the user (so far, so normal). When an event is expanded, there is an 'Event Actions' button that allows users to, among other things, view the raw event.</P> <P>Some of my users report that they don't have this button. </P> <P>Because we have a Gordian knot of LDAP and AD authentication mechanisms, overlapping and inherited roles, and opaque role-index mappings, i can't easily figure out what makes those particular users different from the rest.</P> <P>Question: Is it possible to construct a role that prevents the "Event Actions" button from being displayed ? </P> Mon, 03 Apr 2017 21:45:28 GMT robgarner 2017-04-03T21:45:28Z https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301332#M90730 <P>I use Splunk as an admin and most of my users are power users. Following a syntactically valid search, a list of matching events is available to the user (so far, so normal). When an event is expanded, there is an 'Event Actions' button that allows users to, among other things, view the raw event.</P> <P>Some of my users report that they don't have this button. </P> <P>Because we have a Gordian knot of LDAP and AD authentication mechanisms, overlapping and inherited roles, and opaque role-index mappings, i can't easily figure out what makes those particular users different from the rest.</P> <P>Question: Is it possible to construct a role that prevents the "Event Actions" button from being displayed ? </P> Mon, 03 Apr 2017 21:45:28 GMT https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301332#M90730 robgarner 2017-04-03T21:45:28Z https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301333#M90731 <P>No. Permissions Inherited from roles CANNOT be dis-inherited. You will need to create find the permission that enables this, create a role that has ONLY this permission, remove this permission from all other roles, then selectively add the new role to the users/roles that should have it.</P> Mon, 03 Apr 2017 22:23:28 GMT https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301333#M90731 woodcock 2017-04-03T22:23:28Z https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301334#M90732 <P>I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).</P> <P>In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.</P> <P>Thanks for the comment about constructing roles, though !<BR /> -Rob</P> Wed, 10 May 2017 14:28:59 GMT https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301334#M90732 robgarner 2017-05-10T14:28:59Z https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301335#M90733 <P>And maybe also this can be the reason why you see it some times and some other time not. It depends which kind of time frame you are using on your search. If you are using real-time search then this button isn't there, but all other cases it is.</P> <P>--<BR /> Ismo</P> Tue, 26 Sep 2017 10:22:09 GMT https://community.splunk.com/t5/Splunk-Search/quot-Event-Action-quot-button-not-displayed-for-some-users/m-p/301335#M90733 isoutamo 2017-09-26T10:22:09Z