Disable external UI URIs

[deyeo]

I would like to disable external UI URIs. yes, i'm paranoid about security.

I saw in the ../splunk/etc/system/default/web.conf file that this can possibility be done.

external UI URIs

serviceFormPostURL = http://headlamp.splunk.com/event/add

userRegistrationURL = https://www.splunk.com/index.php/pre_reg?destination=prod_reg

userEntTrialRegistrationURL = https://www.splunk.com/index.php/sign_up?destination=prod_reg

userResendRegistrationURL =https://www.splunk.com/index.php/pre_reg?destination=prod_resend

updateCheckerBaseURL = https://quickdraw.splunk.com/js/

docsCheckerBaseURL=https://quickdraw.splunk.com/help

Are there any impact if they are disabled? How do i disable them? Directly comment these lines in the default web.conf?

[sideview · Accepted solution]

They can all be set to null, which will turn off everything that might hit splunk.com

But never edit the files in the default directory. You should, and always can, edit the same files, stanzas and keys, by making the same changes over in the 'local' directory.

in $SPLUNK_HOME/etc/system/local/web.conf,

add a [settings] stanza if you dont have one already, and then under [settings], add the following:

serviceFormPostURL = 
userRegistrationURL = 
userEntTrialRegistrationURL = 
userResendRegistrationURL = 
updateCheckerBaseURL = 
docsCheckerBaseURL=

It looks weird but that will null them all out.

[araitz]

Yes, that should be fine, though if anyone browses to the parts of Splunk that attempt to connect to Splunkbase, they might not have the experience that they are expecting.

[deyeo]

how about the $SPLUNK_HOME/etc/system/default/server.conf file which contains the following:

In 4.1.x,
[applicationsManagement]
url = http://www.splunkbase.com/api/apps
loginUrl = http://www.splunkbase.com/api/account:login/

can they be nulled without any negative impact to Splunk?