Splunk Search

Block access to Manager

steveirogers
Communicator

I have seen several questions about restricting access to "Manager" but all of the answers seem to require coding JavaScript.
I do not understand why this is not a "built-in" capability.

I have defined a new role that only has search capability to a specific index. Yet the users in that role have administrative ability via the "Manager" link to change configuration settings. That does not make any sense.

Is there a different way to accomplish this besides coding/modify XML?

I am running Splunk 4.0.3 build 65638.

Tags (1)
0 Karma
1 Solution

mfrost8
Builder

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

View solution in original post

frankfowler
Explorer

steveirogers
Communicator

Thanks Frank. I will check into that as well.

0 Karma

mw
Splunk Employee
Splunk Employee

The Manager link doesn't immediately just give them admin access. Users have their own "knowledge objects" such as searches and macros. They access to these through Manager. They have access to what they create or what you give them access to. If you don't want them to have access to something, manage the permissions of it.

0 Karma

mfrost8
Builder

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

View solution in original post

mfrost8
Builder

I'm not certain how that works. I would guess that might create configuration within a user's own, local configuration ($SPLUNK_HOME/etc/users/) so it's not tweaking the global config.

If you don't even want that, you might want to file an enhancement request asking for field extractions to be a capability you can remove from the "user" role (I don't see it there currently as a capability).

0 Karma

steveirogers
Communicator

Thanks very much. I did some more testing and you are correct in that most of the actual fields are restricted when the user clicks on the manager link. However, if the user goes to "Manager --> Field Extractions", then it appears that they can change some of the values in "transforms.conf" and save the changes.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!