Dashboards & Visualizations

Disable external UI URIs

deyeo
Path Finder

I would like to disable external UI URIs. yes, i'm paranoid about security.

I saw in the ../splunk/etc/system/default/web.conf file that this can possibility be done.

external UI URIs

serviceFormPostURL = http://headlamp.splunk.com/event/add

userRegistrationURL = https://www.splunk.com/index.php/pre_reg?destination=prod_reg

userEntTrialRegistrationURL = https://www.splunk.com/index.php/sign_up?destination=prod_reg

userResendRegistrationURL =https://www.splunk.com/index.php/pre_reg?destination=prod_resend

updateCheckerBaseURL = https://quickdraw.splunk.com/js/

docsCheckerBaseURL=https://quickdraw.splunk.com/help

Are there any impact if they are disabled? How do i disable them? Directly comment these lines in the default web.conf?

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

They can all be set to null, which will turn off everything that might hit splunk.com

But never edit the files in the default directory. You should, and always can, edit the same files, stanzas and keys, by making the same changes over in the 'local' directory.

in $SPLUNK_HOME/etc/system/local/web.conf,

add a [settings] stanza if you dont have one already, and then under [settings], add the following:

serviceFormPostURL = 
userRegistrationURL = 
userEntTrialRegistrationURL = 
userResendRegistrationURL = 
updateCheckerBaseURL = 
docsCheckerBaseURL=

It looks weird but that will null them all out.

View solution in original post

sideview
SplunkTrust
SplunkTrust

They can all be set to null, which will turn off everything that might hit splunk.com

But never edit the files in the default directory. You should, and always can, edit the same files, stanzas and keys, by making the same changes over in the 'local' directory.

in $SPLUNK_HOME/etc/system/local/web.conf,

add a [settings] stanza if you dont have one already, and then under [settings], add the following:

serviceFormPostURL = 
userRegistrationURL = 
userEntTrialRegistrationURL = 
userResendRegistrationURL = 
updateCheckerBaseURL = 
docsCheckerBaseURL=

It looks weird but that will null them all out.

araitz
Splunk Employee
Splunk Employee

Yes, that should be fine, though if anyone browses to the parts of Splunk that attempt to connect to Splunkbase, they might not have the experience that they are expecting.

0 Karma

deyeo
Path Finder

how about the $SPLUNK_HOME/etc/system/default/server.conf file which contains the following:

In 4.1.x,
[applicationsManagement]
url = http://www.splunkbase.com/api/apps
loginUrl = http://www.splunkbase.com/api/account:login/

can they be nulled without any negative impact to Splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...