Security

How to restrict users access to real time data and searches?

Path Finder

i want to restrict all users access to real time data and real time searches. how can i do this?

0 Karma
1 Solution

Path Finder

i want to re-stick all users except admin to access real time data and real time searches

0 Karma

Path Finder

Thanks its working

0 Karma

Revered Legend

Go through the instruction on section "Disable real-time search for a user or role" on the same page. Basically remove the capability rtsearch and schedule_rtsearch for the all roles except admin role. Do do this from backend, update the authorize.conf file.

direct link:
https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Restrictrealtimesearch#Disable_real-time_s...

0 Karma

Path Finder

can we do it from back end ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!