Security

Restrict access to Jobs page

aferone
Builder

How is this done? I didn't see anything obvious in user access and roles.

Thanks!

Tags (3)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Hey yeah you're correct.

To make it so they cant see the job, set the correct permissions on the search that created the jobs:

If you want to save a search job after running a search in the Search view, click Job and select Edit Job Settings to bring up the Job Settings dialog. Here you can set the job's Read Permissions (set them to Everyone if you want to share it with others), set the job's Lifetime to 7 days if you want to keep it for inspection, **and get a Link To Job that you can use to share the job with others (if you've set its Permissions to Everyone).**

 You can also save a search job that you've run manually by clicking the Send to Background icon while the search is still running. This action automatically extends the job's lifetime to 7 days and sets its permissions to Everyone. Splunk Enterprise also provides a link that you can use to share the job with others

http://docs.splunk.com/Documentation/Splunk/6.1.9/Knowledge/SupervisejobswiththeJobspage

There's no other way short of using a reverse proxy or something.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Hey yeah you're correct.

To make it so they cant see the job, set the correct permissions on the search that created the jobs:

If you want to save a search job after running a search in the Search view, click Job and select Edit Job Settings to bring up the Job Settings dialog. Here you can set the job's Read Permissions (set them to Everyone if you want to share it with others), set the job's Lifetime to 7 days if you want to keep it for inspection, **and get a Link To Job that you can use to share the job with others (if you've set its Permissions to Everyone).**

 You can also save a search job that you've run manually by clicking the Send to Background icon while the search is still running. This action automatically extends the job's lifetime to 7 days and sets its permissions to Everyone. Splunk Enterprise also provides a link that you can use to share the job with others

http://docs.splunk.com/Documentation/Splunk/6.1.9/Knowledge/SupervisejobswiththeJobspage

There's no other way short of using a reverse proxy or something.

aferone
Builder

Thank you!!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Does this suffice as the answer to you? If it worked please mark it as the answer so that others may find it equally useful.

I converted it to an answer so that you can mark it as such

0 Karma

jkat54
SplunkTrust
SplunkTrust

I believe only admins can see all the jobs, and less privileged users can only see their jobs. That should fall under "admin_all_objects" capability.

http://docs.splunk.com/Documentation/Splunk/6.0.3/Security/Rolesandcapabilities

The link will still be there. If you need to remove it complete from the ui, let us know.

0 Karma

aferone
Builder

Thanks for replying, but I don't think this is entirely correct. A user can see all jobs within each app they have access to. I just tested on a user. They could see jobs in "search" and a couple of other apps they have access to, but they couldn't see jobs in apps they do not have access to.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>