How do I remove links to docs etc when a Splunk instance has no access to the internet?

[tlabue]

Our instances of Splunk 6.0 will have no access to the internet.

I have already added the following the web.conf:
[settings]
updateCheckerBaseURL = 0
userRegistrationURL =
docsCheckerBaseURL =

to keep Splunk from reaching back.

My question in the Search Dashboard has buttons to get Documentation, Tutorial and in the footer links to the Splunk site. My users are going to try and click these buttons. Is there any way to remove these from the Search dashboard?

Thanks!

[martin_mueller · Accepted solution]

I see... removing all links to splunk.com from the interface is quite some task, but it's certainly possible. There's no simple way that I know of... for example, the links in the footer are defined in share/splunk/search_mrsparkle/exposed/js/views/shared/footer/Master.html (changes require rebuilding the .js files in share/splunk/search\_mrsparkle/exposed/js/build).

Any changes made down there likely won't be supported, and certainly won't survive a Splunk upgrade.
Personally, I'd prefer user education over too much fiddling.

[ggb667]

This is a secure system disconnected from the internet. Not an unusual situation at all. The system should be set up to expect to NOT have internet access at all by default. One should need to take a positive action to enable internet extensions for Splunk (and all applications).

[tlabue]

The servers Splunk is installed on, will not have access to the internet. Client browsers also will not have access to internet. Both are on isolated networks.

[martin_mueller]

Is it just going to be the servers that don't have internet access or are the users (= client browsers) shut in as well?