How to restrict users access to real time data and searches?

[sravankaripe]

i want to restrict all users access to real time data and real time searches. how can i do this?

[somesoni2 · Accepted solution]

Here you go

https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Restrictrealtimesearch

[sravankaripe]

i want to re-stick all users except admin to access real time data and real time searches

[sravankaripe]

Thanks its working

[somesoni2]

Go through the instruction on section "Disable real-time search for a user or role" on the same page. Basically remove the capability rtsearch and schedule_rtsearch for the all roles except admin role. Do do this from backend, update the authorize.conf file.

direct link:
https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Restrictrealtimesearch#Disable_real-time_s...

[sravankaripe]

can we do it from back end ?