Security

Splunk User search limit

spl_unker
Explorer

Is it possible to restrict some of the user/roles from running searches for all time ?

0 Karma
1 Solution

nickhills
Ultra Champion

Yes,

You can create a new role and configure this new role with a restriction.

From the authorize.conf docs:

srchTimeWin = <number>
* Maximum time span of a search, in seconds.
    * This time window limit is applied backwards from the latest time
      specified in a search.
* By default, searches are not limited to any specific time window.
* To override any search time windows from imported roles, set this to '0'
  (infinite), as the 'admin' role does.
* -1 is a special value that implies no search window has been set for this role
    * This is equivalent to not setting srchTimeWin at all, which means it
      can be easily overridden by an imported role

https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Rolesandcapabilities

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Yes,

You can create a new role and configure this new role with a restriction.

From the authorize.conf docs:

srchTimeWin = <number>
* Maximum time span of a search, in seconds.
    * This time window limit is applied backwards from the latest time
      specified in a search.
* By default, searches are not limited to any specific time window.
* To override any search time windows from imported roles, set this to '0'
  (infinite), as the 'admin' role does.
* -1 is a special value that implies no search window has been set for this role
    * This is equivalent to not setting srchTimeWin at all, which means it
      can be easily overridden by an imported role

https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Rolesandcapabilities

If my comment helps, please give it a thumbs up!
0 Karma

spl_unker
Explorer

Thank you @nickhillscpl it worked 🙂

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>