How to configure a role to disable the capability to create saved searches?



We have configured a role to disable the capability to create saved searches, adding only the capabilities:

But I have found that users with this role still can create saved searches.

Any advice?


0 Karma

Super Champion

maybe, try disabling these capabilities for this role..
schedule_search Schedule saved searches, create and update alerts, and review triggered alert information.
schedule_rtsearch Schedule real-time saved searches. In order for a user to use this capability their role must also have the schedule_search capability.

>>> Happy Splunking !
0 Karma


Hi inventsekar,

Did you see any of the capabilities that you said in the list that I provide of the role that i configure?


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...